How often do you have to restart your web server?

@rhunter007:

Is this normal, or does it sound like I have a problem with the setup of my apache server?

Thanks for any advice.

No, it doesn't sound normal. Next time it happens, before you restart take a look at your process table (ps/top) (runaway cgi?), memory usage for the system, disk space availability, system logs and dmesg for any odd entries, etc.

What version of Apache, what modules and add-ons you have compiled in (php/modssl)?

Risto

When you login to your Linode to restart Apache, are you ssh'ing into your Linode, or are you ssh'ing into the host for console access?

-Chris

@rko:

What version of Apache, what modules and add-ons you have compiled in (php/modssl)?

Risto

% ./httpd -v

Server version: Apache/1.3.28 (Unix)

Here are my compiled in modules:

./httpd -l
Compiled-in modules:
  http_core.c
  mod_env.c
  mod_log_config.c
  mod_mime.c
  mod_negotiation.c
  mod_status.c
  mod_include.c
  mod_autoindex.c
  mod_dir.c
  mod_cgi.c
  mod_asis.c
  mod_imap.c
  mod_actions.c
  mod_userdir.c
  mod_alias.c
  mod_access.c
  mod_auth.c
  mod_so.c
  mod_setenvif.c
  mod_so.c
suexec: enabled; valid wrapper /usr/local/apache/bin/suexec

But this doesn't list php, dav, and ssl which I have installed, but I think I did them using the "mod_so" technique (sorry, I'm a newbie.).

@caker:

When you login to your Linode to restart Apache, are you ssh'ing into your Linode, or are you ssh'ing into the host for console access

I am ssh'ing just normally…I type "ssh ".

Also, you folks got me curious and I looked in my error_log for apache and found these entries:

[Sat Aug 30 06:33:29 2003] [error] [client 38.117.18.156] Invalid method in request \x04\
\x01
[Sat Aug 30 06:33:49 2003] [error] [client 38.117.18.156] Invalid method in request \x05\
\x01
[Sun Aug 31 05:11:33 2003] [error] [client 65.39.131.228] File does not exist: /usr/loca\
l/apache/htdocs/scripts/nsiislog.dll
[Sun Aug 31 05:56:02 2003] [error] [client 64.26.137.228] File does not exist: /usr/loca\
l/apache/htdocs/scripts/..%5c%5c../winnt/system32/cmd.exe
[Sun Aug 31 08:58:29 2003] [error] [client 62.49.40.122] File does not exist: /usr/local\
/apache/htdocs/scripts/..%5c%5c../winnt/system32/cmd.exe
[Sun Aug 31 12:38:34 2003] [error] [client 195.66.205.11] File does not exist: /usr/loca\
l/apache/htdocs/scripts/nsiislog.dll
[Sun Aug 31 13:01:23 2003] [error] [client 218.153.158.134] File does not exist: /usr/lo\
cal/apache/htdocs/scripts/nsiislog.dll
[Sun Aug 31 15:44:23 2003] [error] [client 211.180.229.19] Invalid method in request SEA\
RCH / HTTP/1.1
[Sun Aug 31 16:13:07 2003] [error] [client 80.17.244.96] File does not exist: /usr/local\
/apache/htdocs/scripts/nsiislog.dll
[Sun Aug 31 21:13:14 2003] [error] [client 209.216.96.136] File does not exist: /usr/loc\
al/apache/htdocs/NULL.printer
[Sun Aug 31 21:47:14 2003] [error] [client 217.59.145.130] File does not exist: /usr/loc\
al/apache/htdocs/scripts/..%5c%5c../winnt/system32/cmd.exe
[Mon Sep  1 02:24:42 2003] [error] [client 80.142.120.79] File does not exist: /usr/loca\
l/apache/htdocs/scripts/nsiislog.dll

Is someone trying to hack me? Is this to be expected?

It looks like those entires are just some bot running which tries to find away into your system.

All of those are windows files, usually an easy way in as most people do not secure windows properly.

They can not get very far, but if you really want to stop them, add their IPs to your firewall to stop them from the start.

Adam

rhunter007:

If you still have the problem with apache dying check your syslog and the output of 'dmesg'. I know on mine every once in a while the Kernel will kill either my apache processes or my mysql processes:

From dmesg:

Out of Memory: Killed process PID.

Out of Memory: Killed process PID.

If you do find this on your node (the Out of Memory messages), and it's killing apache, then check your access_logs to see if someone/thing is hitting your box fast and hard. Apache should operate find under heavy load, but if one your pages does a lot of work each time it's called and it gets called alot quickly you could run into this problem.

I am still working out ways that I can fix this on my node. I'm sure I have to tune mysql someway that it doesn't eat all of the memory under heavy web traffic load. But the magic setting eludes me since all my stress tests work fine, but then it goes belly up when someone else does it. sigh

HTH.

@funkknight:

HTH.

So far my website is still up. I'll report back once (if) it crashes again. Thanks for the tips.