| View previous topic :: View next topic |
| Author |
Message |
To
Veteran
Joined: 12 Apr 2003
Posts: 1145
Location: Coimbra, Portugal
|
 Posted: Fri May 07, 2004 9:30 am Post subject: Apache and number of process |
 |
|
Hya,
Since my last update I've lots of apache processes running, is this any unusuall behavior?
Using Apache 2.0.49-r1.
From my /etc/apache2/conf/apache2.conf file:
| Code: | StartServers 3
MinSpareServers 3
MaxSpareServers 5
MaxClients 150
MaxRequestsPerChild 0 |
I've changed the defaults trying to fix this.
| Quote: | root @ gandalf $ > ps aux| grep apache
root 25636 0.0 2.1 27812 11032 ? Ss May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 1190 0.0 1.7 26552 8796 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 8180 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 1631 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 17778 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 10040 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 4813 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 14544 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 26406 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 17930 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 23911 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 9660 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 31601 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 27526 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 3767 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 28363 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 32372 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 1477 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 1618 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 9293 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 10992 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 24403 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 3338 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 26647 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 4856 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 28941 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 21761 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 31810 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 9815 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 8462 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 20403 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 18999 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 1984 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 16300 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 32661 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 29581 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 17801 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 11060 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 20349 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 11329 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 1669 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 30257 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 30810 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 18170 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 3728 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 27391 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 23290 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 3791 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 31036 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 24501 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 12228 0.0 3.4 89576 17912 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 32074 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 28551 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 6966 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 2452 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 20138 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 23764 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
apache 7061 0.0 3.4 89564 17928 ? S May06 0:00 /usr/sbin/apache2 -k start -D SSL -D PHP4 -E /var/log/apache2/startuperror.log -E /var/log/apache2/startuperror.log
root 28982 0.0 0.0 1404 468 pts/7 S+ 10:39 0:00 grep apache
root @ gandalf $ > |
Any advice?
Tó
_________________
------------------------------------------------
Linux Gandalf 3.2.35-grsec
Gentoo Base System version 2.2
------------------------------------------------ |
|
| Back to top |
|
 |
delta407
Bodhisattva
Joined: 23 Apr 2002
Posts: 2876
Location: Chicago, IL
|
| Posted: Fri May 07, 2004 6:37 pm Post subject: Re: Apache and number of process |
|
|
| To wrote: | Since my last update I've lots of apache processes running, is this any unusuall behavior?
...
Any advice? |
Figure out what's making all those processes, I'd say. 
Apache forks new processes to handle requests. If you've got fifty concurrent data transfers, it'll use fifty processes. That's not really a big deal, since UNIX systems are good at working with processes, and Apache is good at multiprocess HTTP serving. MaxClients acts as a hard-limiter to prevent the process load from getting insane (if you get Slashdotted, for instance)...
I'd suggest checking your access/error logs, to see if anything fishy is happening.
_________________
I don't believe in witty sigs. |
|
| Back to top |
|
|
Chris W
l33t
Joined: 25 Jun 2002
Posts: 972
Location: Brisbane, Australia
|
| Posted: Fri May 07, 2004 10:30 pm Post subject: |
|
|
Your MaxClients setting allows Apache to start up to 150 processess to meet demand. AFAICT processes, once started, will not terminate unless the MaxRequestsPerChild setting is non-zero. At all times your server will try to maintain 5 servers that are running but idle (MaxSpareServers) and it will start creating idle processes, one per second, if the spare server count drops to 3 (MinSpareServers). This behaviour allows for fast response to new requests while providing time to start more processes.
With the configuration shown the number of process will match the peak load and not decrease. You've probably had a spike in use that has spawned all the processes you see.
_________________
Cheers,
Chris W
"Common sense: The collection of prejudices acquired by age 18." -- Einstein |
|
| Back to top |
|
|
UberLord
Retired Dev
Joined: 18 Sep 2003
Posts: 6835
Location: Blighty
|
|
| Back to top |
|
|
adaptr
Watchman
Joined: 06 Oct 2002
Posts: 6730
Location: Rotterdam, Netherlands
|
| Posted: Sat May 08, 2004 2:40 pm Post subject: |
|
|
| Chris W wrote: | | With the configuration shown the number of process will match the peak load and not decrease. You've probably had a spike in use that has spawned all the processes you see. |
That's just not so.
Apache2's prefork mpm (which is what he is using) will simply fork that amount of processes on startup and keep it at that level.
He should switch to the worker mpm, like the Lord said.
EDIT: by the way, none of this needs nptl.
_________________
>>> emerge (3 of 7) mcse/70-293 to /
Essential tools: gentoolkit eix profuse screen |
|
| Back to top |
|
|
UberLord
Retired Dev
Joined: 18 Sep 2003
Posts: 6835
Location: Blighty
|
|
| Back to top |
|
|
To
Veteran
Joined: 12 Apr 2003
Posts: 1145
Location: Coimbra, Portugal
|
| Posted: Mon May 10, 2004 9:56 am Post subject: |
|
|
Ok seams like I found the problem, from my access log:
| Quote: | 213.22.169.104 - - [08/May/2004:19:58:10 +0100] "OPTIONS / HTTP/1.1" 200 - "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"
213.22.167.204 - - [08/May/2004:22:19:55 +0100] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\...(this continues for lines and lines) |
Is this any kind of virus or worm? What's the best option here?
Tó
_________________
------------------------------------------------
Linux Gandalf 3.2.35-grsec
Gentoo Base System version 2.2
------------------------------------------------ |
|
| Back to top |
|
|
To
Veteran
Joined: 12 Apr 2003
Posts: 1145
Location: Coimbra, Portugal
|
| Posted: Mon May 10, 2004 10:08 am Post subject: |
|
|
K, I was reading the logs from my other apache client, that's why I've only saw what's on my last port. Seams like IIS WebDAV exploit attempt.
Thanx for the answers I've received.
Tó
_________________
------------------------------------------------
Linux Gandalf 3.2.35-grsec
Gentoo Base System version 2.2
------------------------------------------------ |
|
| Back to top |
|
|
|
Networking & Security
