High server loads on VPS caused by /usr/local/apache/bin/httpd -DSSL

Hi,

The last 1.5 days i'm having strange high CPU processes running. I don't know what is wrong or where to look. I"m hoping somebody can help me out. I rebooted the server, tried killing the PID's but they keep coming back.

Here's some stats.

processes:

And.

top/mem

 

please tell what parameters in httpd.conf

MinSpareServers
MaxSpareServers

MaxClients

KeepAlive
MaxKeepAliveRequests
KeepAliveTimeout

 

MinSpareServers 5
MaxSpareServers 10

MaxClients 150

KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 15

 

This is my config (a high loaded server)
Timeout 400
KeepAlive On
MaxKeepAliveRequests 400
KeepAliveTimeout 25
MinSpareServers 35
MaxSpareServers 350
StartServers 35
MaxClients 512
MaxRequestsPerChild 10000

Look at you number of file descriptors. Usualy you system is comming with a limit of 1024 fd. You need to change that values.
ulimit -a to see the number of allowed file descriptors
lsof -u www-data | wc -l to see the number of file desriptors opened

www-data is the user of apache process if you have debian than is ok if you have redhat or mandriva probably is apache or httpd

Regards
Adrian

 

APACHE starts a child proccess for its every http session. like if 10 users are online it will create those many child proccess. when request is servered apache process is kept in memory to process next request. there is no activity the it runs only number of child proccess equivalant to MinSpareServers .if there are too many request and then you may see lot of apache proccess in memory.
your config look normal and should not have problem of keeplive. also as sacx13 said adding "MaxRequestsPerChild" also helps to close unwanted opened child procs

 

Thanks for all the info guys I learned alot.

(Unfortunately) the peak only lasted 2 days, now it's back to normal.

 

You might also consider checking your apache logs for the scripts or the file that has been frequently access for any anomalies or abnormalities. it might be an attack or a site grabber.

 

Please check if your apache is really in /usr/local/apache/bin/httpd

I'm using debian and there is no /usr/local/apache here! And the same symptom happened here.. (high load caused by this process)..

 

i doubt apache can be installed everywhere and it depends upon the person who compiled it, by default the location was either:

/usr/local/ or /opt

and it really depend also on the packager of your apache pack or the lamp pack

 

Set "Timeout" value to "Timeout 300"
Change "KeepAlive on" to "KeepAlive off"
Set "MinSpareServers" to "MinSpareServers 8"
Set "MaxSpareServers" to "MaxSpareServers 13"
Set "MaxRequestsPerChild" to "MaxRequestsPerChild 50"
Set "HostnameLookups" to "HostnameLookups Off"


Regards

 

Yeah, that's true, but by default debian installs it's executables in /usr/bin and other data in other directories.

I found an exploit named ssh.d.worm (for more info, search google with that string) that creates a process and hides it under the name "/usr/local/apache/bin/httpd -DSSL", so if you check with PS that's what you see, but if you check with another tools you can see that's really a "perl".

It was my case, and I thought it can be this case too, as Choller killed it, and rebooted the machine and the process started again..

Well, hope it's not the case, but it's worth to check, I think.

Sorry for my english!
See ya!
Luar

 

lsof can be a quite good tool

 

I kill process PID and get back normal

 

Hi I have a similar prob - I run 200 odd proxies on a VPS - memory used is never above 9% but server load is often at 100 to 200%. Current Running Processes is full of /usr/local/apache/bin/httpd -DSSL entries. My config file KeepAlive On
MaxKeepAliveRequests 15
KeepAliveTimeout 1
MinSpareServers 20
MaxSpareServers 100
StartServers 100
MaxClients 250
MaxRequestsPerChild 200 - suggestions welcome! Sheree