Apache перегружен

Volodymyr

Уже несколько раз за сегодня перегружался апач, в топе load averages 5-9 Ненадолго памагает рестарт апача.

Как посмотреть в чем может быть причина?

Хостинг HostFood.ru · **Хостинг HostFood.ru**

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

лог...

Volodymyr

Какой именно?

апача error.log
+ у тебя fastcqi?
не обновлял ли апачь\php случаем
и много ли сайтов висит?

Volodymyr

Raven2000 писал(а):апача error.log

У каждого сайта свой error.log

Код: Выделить всё

# tail /var/log/httpd-error.log
[Wed Feb 04 13:37:01 2009] [notice] Digest: generating secret for digest authentication ...
[Wed Feb 04 13:37:01 2009] [notice] Digest: done
[Wed Feb 04 13:37:02 2009] [notice] Apache/2.2.11 (FreeBSD) mod_ssl/2.2.11 OpenSSL/0.9.8e DAV/2 PHP/5.2.8 with Suhosin-Patch configured -- resuming normal operations
[Wed Feb 04 13:40:59 2009] [error] [client 193.19.82.5] Invalid URI in request HTTP/1.1 200 OK
[Wed Feb 04 13:41:00 2009] [error] [client 193.19.82.5] Invalid URI in request HTTP/1.1 200 OK
[Wed Feb 04 13:46:39 2009] [notice] SIGHUP received.  Attempting to restart
[Wed Feb 04 13:46:40 2009] [notice] Digest: generating secret for digest authentication ...
[Wed Feb 04 13:46:40 2009] [notice] Digest: done
[Wed Feb 04 13:46:41 2009] [notice] Apache/2.2.11 (FreeBSD) mod_ssl/2.2.11 OpenSSL/0.9.8e DAV/2 PHP/5.2.8 with Suhosin-Patch configured -- resuming normal operations
[Wed Feb 04 13:46:53 2009] [error] [client 213.160.140.102] request failed: error reading the headers

Raven2000 писал(а):+ у тебя fastcqi?

Код: Выделить всё

# apachectl -M
Loaded Modules:
 core_module (static)
 mpm_prefork_module (static)
 http_module (static)
 so_module (static)
 authn_file_module (shared)
 authn_dbm_module (shared)
 authn_anon_module (shared)
 authn_default_module (shared)
 authn_alias_module (shared)
 authz_host_module (shared)
 authz_groupfile_module (shared)
 authz_user_module (shared)
 authz_dbm_module (shared)
 authz_owner_module (shared)
 authz_default_module (shared)
 auth_basic_module (shared)
 auth_digest_module (shared)
 file_cache_module (shared)
 cache_module (shared)
 disk_cache_module (shared)
 dumpio_module (shared)
 include_module (shared)
 filter_module (shared)
 charset_lite_module (shared)
 deflate_module (shared)
 log_config_module (shared)
 logio_module (shared)
 env_module (shared)
 mime_magic_module (shared)
 cern_meta_module (shared)
 expires_module (shared)
 headers_module (shared)
 usertrack_module (shared)
 unique_id_module (shared)
 setenvif_module (shared)
 version_module (shared)
 ssl_module (shared)
 mime_module (shared)
 dav_module (shared)
 status_module (shared)
 autoindex_module (shared)
 asis_module (shared)
 info_module (shared)
 cgi_module (shared)
 dav_fs_module (shared)
 vhost_alias_module (shared)
 negotiation_module (shared)
 dir_module (shared)
 imagemap_module (shared)
 actions_module (shared)
 speling_module (shared)
 userdir_module (shared)
 alias_module (shared)
 rewrite_module (shared)
 php5_module (shared)

Raven2000 писал(а):не обновлял ли апачь\php случаем

Jan 22 14:33

Raven2000 писал(а):и много ли сайтов висит?

32

Volodymyr

Код: Выделить всё

last pid: 25232;  load averages:  2.59,  4.67,  5.41                                                                                up 1+19:51:25  14:08:02
171 processes: 3 running, 167 sleeping, 1 zombie
CPU states: 17.1% user,  0.0% nice, 31.5% system,  0.0% interrupt, 51.4% idle
Mem: 469M Active, 6514M Inact, 424M Wired, 393M Cache, 214M Buf, 89M Free
Swap: 16G Total, 32K Used, 16G Free

  PID USERNAME       THR PRI NICE   SIZE    RES STATE  C   TIME   WCPU COMMAND
25117 www              1  -4    0   137M 18952K ufs    1   0:13 27.62% httpd
25088 www              1  -4    0   137M 18156K CPU2   1   0:23 22.24% httpd
25057 www              1  -4    0   137M 18152K ufs    1   0:29 17.84% httpd
25139 www              1  -4    0   137M 18808K ufs    1   0:29  2.05% httpd
25091 www              1  96    0   137M 19204K select 1   0:02  1.76% httpd
25075 www              1  96    0   137M 19064K select 1   0:02  1.71% httpd
25179 www              1  96    0   137M 19272K select 2   0:01  1.52% httpd
25136 www              1  96    0   137M 19096K select 0   0:02  1.52% httpd
25216 www              1   4    0   137M 19072K accept 1   0:01  1.33% httpd
25046 www              1   4    0   137M 18996K accept 0   0:02  1.27% httpd
25171 www              1  96    0   137M 19132K CPU0   0   0:02  1.22% httpd
25067 www              1  96    0   137M 18984K select 1   0:01  1.17% httpd
25049 www              1  96    0   137M 19116K select 1   0:02  1.12% httpd
25187 www              1  96    0   137M 18888K select 2   0:01  1.02% httpd
25141 www              1  96    0   138M 20004K select 0   0:02  0.98% httpd
25145 www              1  96    0   137M 19064K select 1   0:02  0.98% httpd
25078 www              1  96    0   137M 18996K select 3   0:01  0.98% httpd
25073 www              1   4    0   137M 19032K accept 3   0:01  0.98% httpd
25231 www              1  96    0   137M 18972K select 0   0:01  0.95% httpd
25169 www              1  96    0   136M 18340K select 1   0:01  0.88% httpd
25215 www              1  96    0   137M 19096K select 3   0:01  0.87% httpd
25098 www              1   4    0   137M 18836K accept 2   0:01  0.83% httpd
25185 www              1  20    0   137M 19000K lockf  2   0:01  0.81% httpd
25119 www              1   4    0   137M 19012K accept 0   0:01  0.78% httpd
25042 www              1  96    0   137M 19220K select 1   0:01  0.78% httpd
25177 www              1  96    0   137M 19096K select 1   0:01  0.73% httpd
25126 www              1  96    0   137M 19108K select 2   0:01  0.73% httpd
25166 www              1  96    0   137M 19088K select 1   0:01  0.73% httpd
25054 www              1  -4    0   138M 20080K ufs    3   0:01  0.73% httpd
25210 www              1  96    0   137M 18292K select 2   0:01  0.72% httpd
25107 www              1  -4    0   137M 19088K ufs    1   0:01  0.68% httpd
25109 www              1  96    0   137M 18992K select 3   0:01  0.68% httpd
25040 www              1   4    0   137M 18988K accept 0   0:01  0.68% httpd
25203 www              1  96    0   137M 19020K select 0   0:01  0.67% httpd
25198 www              1  96    0   137M 19060K select 1   0:01  0.66% httpd
25223 www              1  96    0   137M 19020K select 2   0:00  0.63% httpd
25208 www              1   4    0   137M 18292K accept 0   0:01  0.61% httpd
25200 www              1  96    0   137M 19012K select 2   0:01  0.61% httpd
25050 www              1  96    0   137M 18960K select 2   0:01  0.59% httpd

Volodymyr

Код: Выделить всё

# ps -aux | grep httpd
www         722 28.2  0.2 139820 19236  ??  R     2:10PM   0:29.78 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         701 17.6  0.2 139820 18544  ??  D     2:10PM   0:24.25 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         754 11.8  0.2 139820 18200  ??  D     2:10PM   0:15.74 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         816 10.4  0.2 139820 19224  ??  S     2:10PM   0:30.58 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         723  7.6  0.2 139820 19204  ??  S     2:10PM   0:30.53 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         824  5.6  0.2 139820 19048  ??  D     2:10PM   0:02.46 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         797  1.8  0.2 139948 19248  ??  S     2:10PM   0:01.05 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         793  1.7  0.2 139820 17572  ??  D     2:10PM   0:14.37 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         946  1.7  0.2 139820 19240  ??  S     2:11PM   0:01.24 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         730  1.7  0.2 139820 19212  ??  S     2:10PM   0:04.37 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         829  1.3  0.2 139820 19140  ??  S     2:10PM   0:01.11 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         760  1.1  0.2 139948 19244  ??  S     2:10PM   0:05.29 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         944  1.1  0.2 139948 19316  ??  S     2:11PM   0:03.93 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         836  1.1  0.2 139820 19228  ??  S     2:10PM   0:30.09 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         971  0.8  0.2 140972 20380  ??  S     2:12PM   0:03.74 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         736  0.7  0.2 139820 19032  ??  D     2:10PM   0:11.13 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         716  0.7  0.2 139948 19288  ??  S     2:10PM   0:01.66 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         832  0.7  0.2 138924 18428  ??  S     2:10PM   0:03.64 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         811  0.6  0.2 139820 18056  ??  D     2:10PM   0:30.48 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         773  0.6  0.2 139948 19152  ??  S     2:10PM   0:05.38 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         810  0.6  0.2 139820 19320  ??  S     2:10PM   0:02.54 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         958  0.5  0.2 138924 18328  ??  S     2:11PM   0:03.27 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         972  0.5  0.2 139820 19152  ??  I     2:12PM   0:02.93 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         940  0.4  0.2 139948 18700  ??  D     2:11PM   0:04.25 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         839  0.4  0.2 139820 19124  ??  D     2:10PM   0:00.66 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         954  0.4  0.2 139948 19312  ??  S     2:11PM   0:03.81 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         798  0.4  0.2 139948 19288  ??  S     2:10PM   0:03.60 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         711  0.4  0.2 139820 18664  ??  D     2:10PM   0:02.28 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         743  0.3  0.2 139948 19320  ??  S     2:10PM   0:04.23 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         987  0.2  0.2 139820 18856  ??  S     2:12PM   0:01.46 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         973  0.2  0.2 139948 19296  ??  S     2:12PM   0:02.29 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         768  0.1  0.2 139948 19264  ??  D     2:10PM   0:04.93 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         960  0.1  0.2 139820 18036  ??  D     2:11PM   0:01.04 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         807  0.1  0.2 139820 18808  ??  D     2:10PM   0:01.63 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         985  0.0  0.2 139820 18032  ??  D     2:12PM   0:00.65 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         966  0.0  0.2 139948 19316  ??  D     2:11PM   0:02.88 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         822  0.0  0.2 139820 19308  ??  D     2:10PM   0:02.68 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         777  0.0  0.2 139948 19364  ??  D     2:10PM   0:04.36 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         789  0.0  0.2 139948 19324  ??  S     2:10PM   0:02.47 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         718  0.0  0.2 140972 20108  ??  D     2:10PM   0:03.94 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         695  0.0  0.2 140972 20248  ??  D     2:10PM   0:01.57 /usr/local/sbin/httpd -DNOHTTPACCEPT
root        613  0.0  0.2 137772 15772  ??  Ss    2:10PM   0:00.35 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         690  0.0  0.2 139948 19200  ??  D     2:10PM   0:02.79 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         691  0.0  0.2 139948 18984  ??  D     2:10PM   0:06.23 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         692  0.0  0.2 139948 19136  ??  D     2:10PM   0:01.52 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         697  0.0  0.2 139948 19288  ??  D     2:10PM   0:03.09 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         698  0.0  0.2 139820 19012  ??  D     2:10PM   0:02.42 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         699  0.0  0.2 139820 19136  ??  I     2:10PM   0:04.19 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         702  0.0  0.2 139948 18668  ??  D     2:10PM   0:02.85 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         703  0.0  0.2 139820 19160  ??  D     2:10PM   0:01.23 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         704  0.0  0.2 139820 19192  ??  D     2:10PM   0:01.42 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         705  0.0  0.2 139820 19080  ??  D     2:10PM   0:02.75 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         706  0.0  0.2 139820 19272  ??  D     2:10PM   0:03.34 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         707  0.0  0.2 139820 18772  ??  D     2:10PM   0:01.46 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         709  0.0  0.2 139820 18824  ??  D     2:10PM   0:01.47 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         710  0.0  0.2 139820 18312  ??  D     2:10PM   0:02.37 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         713  0.0  0.2 139820 18032  ??  I     2:10PM   0:00.33 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         714  0.0  0.2 139820 18232  ??  D     2:10PM   0:02.22 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         715  0.0  0.2 139948 19208  ??  I     2:10PM   0:01.47 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         725  0.0  0.2 139820 19412  ??  D     2:10PM   0:30.92 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         726  0.0  0.2 139948 19336  ??  D     2:10PM   0:02.63 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         729  0.0  0.2 139820 18944  ??  D     2:10PM   0:06.21 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         731  0.0  0.2 139820 19152  ??  D     2:10PM   0:01.74 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         732  0.0  0.2 139948 19356  ??  D     2:10PM   0:03.51 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         733  0.0  0.2 139820 19088  ??  S     2:10PM   0:01.65 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         734  0.0  0.2 139948 19332  ??  D     2:10PM   0:05.20 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         735  0.0  0.2 139820 18068  ??  D     2:10PM   0:01.59 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         737  0.0  0.2 139948 19204  ??  D     2:10PM   0:01.53 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         738  0.0  0.2 140844 20072  ??  D     2:10PM   0:01.91 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         739  0.0  0.2 139948 19224  ??  I     2:10PM   0:04.37 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         740  0.0  0.2 139948 19168  ??  D     2:10PM   0:02.54 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         744  0.0  0.2 139948 19240  ??  D     2:10PM   0:02.59 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         745  0.0  0.2 139948 19064  ??  D     2:10PM   0:01.52 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         746  0.0  0.2 139820 18848  ??  D     2:10PM   0:01.68 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         747  0.0  0.2 139948 19160  ??  D     2:10PM   0:01.74 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         749  0.0  0.2 139820 19220  ??  D     2:10PM   0:01.72 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         750  0.0  0.2 139820 19160  ??  D     2:10PM   0:01.72 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         751  0.0  0.2 139820 18316  ??  D     2:10PM   0:01.79 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         752  0.0  0.2 139820 19060  ??  D     2:10PM   0:02.30 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         755  0.0  0.2 139948 19312  ??  D     2:10PM   0:01.97 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         756  0.0  0.2 139948 19388  ??  I     2:10PM   0:01.91 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         757  0.0  0.2 139948 19120  ??  D     2:10PM   0:01.67 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         758  0.0  0.2 140972 20164  ??  D     2:10PM   0:03.89 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         759  0.0  0.2 139948 19312  ??  D     2:10PM   0:04.51 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         762  0.0  0.2 139948 19268  ??  D     2:10PM   0:02.15 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         763  0.0  0.2 139948 19384  ??  D     2:10PM   0:02.77 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         769  0.0  0.2 140972 20084  ??  I     2:10PM   0:03.39 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         770  0.0  0.2 139820 18796  ??  I     2:10PM   0:00.12 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         772  0.0  0.2 139820 17564  ??  D     2:10PM   0:05.95 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         774  0.0  0.2 139820 19064  ??  D     2:10PM   0:02.48 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         775  0.0  0.2 139820 19176  ??  I     2:10PM   0:00.67 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         776  0.0  0.2 139948 18712  ??  D     2:10PM   0:01.61 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         778  0.0  0.2 139820 19216  ??  D     2:10PM   0:02.84 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         779  0.0  0.2 139948 19316  ??  I     2:10PM   0:03.78 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         780  0.0  0.2 139948 19264  ??  D     2:10PM   0:02.05 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         781  0.0  0.2 139820 18888  ??  I     2:10PM   0:00.46 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         782  0.0  0.2 139948 19304  ??  D     2:10PM   0:02.08 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         783  0.0  0.2 139948 19308  ??  D     2:10PM   0:03.31 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         787  0.0  0.2 139820 19160  ??  S     2:10PM   0:02.21 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         791  0.0  0.2 139820 18032  ??  D     2:10PM   0:07.04 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         794  0.0  0.2 139948 19236  ??  S     2:10PM   0:04.67 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         795  0.0  0.2 139948 19304  ??  I     2:10PM   0:02.88 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         799  0.0  0.2 139820 18796  ??  D     2:10PM   0:01.22 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         800  0.0  0.2 139948 19332  ??  I     2:10PM   0:02.55 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         802  0.0  0.3 149164 25524  ??  I     2:10PM   0:02.35 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         805  0.0  0.2 139948 19252  ??  D     2:10PM   0:03.06 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         806  0.0  0.2 139820 18180  ??  D     2:10PM   0:01.35 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         808  0.0  0.2 139820 19260  ??  D     2:10PM   0:01.46 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         809  0.0  0.2 139948 19276  ??  D     2:10PM   0:03.37 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         812  0.0  0.2 139820 19268  ??  D     2:10PM   0:01.76 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         813  0.0  0.2 139948 19352  ??  D     2:10PM   0:02.74 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         814  0.0  0.2 139948 18728  ??  D     2:10PM   0:01.76 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         815  0.0  0.2 139820 19252  ??  I     2:10PM   0:03.15 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         819  0.0  0.2 139820 19488  ??  D     2:10PM   0:02.78 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         820  0.0  0.2 139820 19108  ??  D     2:10PM   0:01.51 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         821  0.0  0.2 139820 18324  ??  D     2:10PM   0:01.68 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         823  0.0  0.2 139948 19276  ??  I     2:10PM   0:03.09 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         826  0.0  0.2 139820 18800  ??  D     2:10PM   0:01.82 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         828  0.0  0.2 139820 18536  ??  D     2:10PM   0:01.40 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         830  0.0  0.2 139948 18712  ??  D     2:10PM   0:03.60 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         833  0.0  0.2 139948 19248  ??  D     2:10PM   0:04.30 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         837  0.0  0.2 139948 18716  ??  I     2:10PM   0:02.21 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         838  0.0  0.2 138796 18016  ??  S     2:10PM   0:00.20 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         939  0.0  0.2 139948 19220  ??  D     2:11PM   0:01.68 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         941  0.0  0.2 139820 19072  ??  I     2:11PM   0:01.07 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         942  0.0  0.2 139948 19400  ??  I     2:11PM   0:02.75 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         943  0.0  0.2 139820 19228  ??  I     2:11PM   0:01.20 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         952  0.0  0.2 139820 19248  ??  I     2:11PM   0:03.11 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         953  0.0  0.2 139820 18204  ??  D     2:11PM   0:00.95 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         955  0.0  0.2 138796 18224  ??  I     2:11PM   0:02.65 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         956  0.0  0.2 139820 18580  ??  D     2:11PM   0:01.04 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         957  0.0  0.2 139820 18512  ??  D     2:11PM   0:01.96 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         959  0.0  0.2 139948 19152  ??  I     2:11PM   0:03.78 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         961  0.0  0.2 139820 19312  ??  D     2:11PM   0:02.89 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         963  0.0  0.2 139948 19204  ??  D     2:11PM   0:01.21 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         964  0.0  0.2 138924 18476  ??  I     2:11PM   0:01.54 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         968  0.0  0.2 139948 19340  ??  D     2:11PM   0:02.99 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         969  0.0  0.2 139820 18388  ??  D     2:11PM   0:00.88 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         970  0.0  0.2 139820 18964  ??  D     2:11PM   0:00.87 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         974  0.0  0.2 139820 18620  ??  D     2:12PM   0:00.98 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         975  0.0  0.2 139948 19224  ??  S     2:12PM   0:02.78 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         976  0.0  0.3 149164 25540  ??  I     2:12PM   0:02.28 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         977  0.0  0.2 139948 19188  ??  D     2:12PM   0:01.83 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         978  0.0  0.2 139820 19156  ??  I     2:12PM   0:01.96 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         979  0.0  0.2 139820 18824  ??  I     2:12PM   0:00.85 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         980  0.0  0.2 139820 19128  ??  I     2:12PM   0:02.02 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         981  0.0  0.2 139820 19052  ??  D     2:12PM   0:00.81 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         982  0.0  0.2 139948 18700  ??  I     2:12PM   0:01.36 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         983  0.0  0.2 139820 19192  ??  I     2:12PM   0:01.12 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         984  0.0  0.2 139820 18488  ??  D     2:12PM   0:01.39 /usr/local/sbin/httpd -DNOHTTPACCEPT
www         986  0.0  0.2 139948 19332  ??  D     2:12PM   0:03.33 /usr/local/sbin/httpd -DNOHTTPACCEPT

hizel · Непрочитанное сообщение **hizel** » 2009-02-04 15:34:36

какие значения параметров

Код: Выделить всё

StartServers 
MinSpareServers
MaxSpareServers
MaxClients  
MaxRequestsPerChild

?

Volodymyr

Код: Выделить всё

ServerRoot "/usr/local"
PidFile /var/run/httpd.pid
ScoreBoardFile /var/run/httpd.scoreboard
Timeout 600
KeepAlive On
MaxKeepAliveRequests 120
KeepAliveTimeout 10
MinSpareServers 10
MaxSpareServers 20
StartServers 15
MaxClients 150
MaxRequestsPerChild 5000

Volodymyr

Код: Выделить всё

last pid:  1953;  load averages: 19.87, 14.24,  9.06                                      up 0+00:30:28  14:40:02
176 processes: 2 running, 174 sleeping
CPU states:  0.1% user,  0.0% nice, 32.1% system,  0.0% interrupt, 67.8% idle
Mem: 469M Active, 270M Inact, 364M Wired, 32K Cache, 214M Buf, 6781M Free
Swap: 16G Total, 16G Free

Думаю что это не трабл апача, а какого-то сайта который зажирает все что может.
Я бы с таким кол-вом серверов все перевел бы на fast-cgi и подрезал бы php.ini каждому.
===
Попоробуй выяснить какой именно вхост==сайт зажирается.

Volodymyr

Raven2000 писал(а):Думаю что это не трабл апача, а какого-то сайта который зажирает все что может.
Я бы с таким кол-вом серверов все перевел бы на fast-cgi и подрезал бы php.ini каждому.

Я cgi не использую вообще, только рнр как модуль апача.

Raven2000 писал(а):Попоробуй выяснить какой именно вхост==сайт зажирается.

Щас отрублю все хосты и по одному повключаю.

ок отпишешься по результатам

wnd · Непрочитанное сообщение **wnd** » 2009-02-04 18:32:13

Volodymyr писал(а):Уже несколько раз за сегодня перегружался апач, в топе load averages 5-9 Ненадолго памагает рестарт апача.

Как посмотреть в чем может быть причина?

Какое максимальное количество коннектов к апачу? И сколько конектов в момент большой нагрузки?
Может есть возможность статику(картинки etc) отдавать не апачем, а чем-то попроще, типа tinyhttpd?

Volodymyr

Из 31 хостов на один валится вот такое добро. Если его отключаю сервер работает нормально. Общего: запрос на / клиент ОС Windows NT 5.1; U; ru

Код: Выделить всё

79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18394 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18987
190.138.146.33 - - [04/Feb/2009:17:32:45 +0200] "GET / HTTP/1.1" 200 18361 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18954
201.11.52.178 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18372 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18965
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18366 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18959
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18404 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18997
190.138.146.33 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18366 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18959
200.102.1.155 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18364 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18957
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18362 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18955
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18407 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 19000
201.66.88.218 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18401 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18994
201.66.88.218 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18408 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 19001
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18403 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18996
200.102.1.155 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18392 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18985
200.102.1.155 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18383 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18976
201.11.52.178 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18399 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18992
201.11.52.178 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18379 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18972
201.66.88.218 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18357 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18950
190.138.146.33 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18365 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18958
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18396 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18989
190.138.146.33 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18391 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18984
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18404 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18997
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18385 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18978
201.11.52.178 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18372 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18965
190.138.146.33 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18386 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18979
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18346 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18939
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18362 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18955
200.102.1.155 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18355 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18948
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18383 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18976
190.138.146.33 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18403 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18996
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18365 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18958
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18385 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18978
201.11.52.178 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18375 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18968
190.138.146.33 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18403 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18996
200.102.1.155 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18397 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18990
201.11.52.178 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18373 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18966
200.102.1.155 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18372 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18965
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18376 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18969
201.66.88.218 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18389 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18982
201.66.88.218 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18379 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18972
201.66.88.218 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18364 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18957
190.138.146.33 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18396 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18989
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18364 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18957
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18370 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18963
201.11.52.178 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18389 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18982
200.102.1.155 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18383 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18976
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18381 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18974
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18367 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18960
190.138.146.33 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18385 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18978
200.102.1.155 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18370 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18963
190.138.146.33 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18372 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18965
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18364 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18957
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18384 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18977
201.11.52.178 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18339 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18932
200.102.1.155 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18363 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18956
201.11.52.178 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18403 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18996
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18380 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18973
190.138.146.33 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18385 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18978
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18377 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18970
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18396 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18989
200.102.1.155 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18400 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18993
201.66.88.218 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18361 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18954
201.66.88.218 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18373 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18966
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18396 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18989
190.138.146.33 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18358 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18951
201.11.52.178 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18385 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18978
190.138.146.33 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18385 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18978
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18376 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18969
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18348 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18941
200.102.1.155 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18374 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18967
189.73.0.135 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18377 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18970
79.172.77.14 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18387 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18980
200.102.1.155 - - [04/Feb/2009:17:32:47 +0200] "GET / HTTP/1.1" 200 18380 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18973
190.138.146.33 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18356 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18949
201.11.52.178 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18380 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18973
79.172.77.14 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18381 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18974
201.11.52.178 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18376 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18969
79.172.77.14 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18366 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18959
201.66.88.218 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18386 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18979
200.102.1.155 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18376 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18969
201.66.88.218 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18379 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18972
201.66.88.218 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18379 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18972
190.138.146.33 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18384 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18977
190.138.146.33 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18405 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18998
200.102.1.155 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18382 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18975
79.172.77.14 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18408 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 19001
201.11.52.178 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18390 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18983
79.172.77.14 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18358 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18951
200.102.1.155 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18389 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18982
79.172.77.14 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18364 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18957
79.172.77.14 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18373 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18966
190.138.146.33 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18378 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18971
201.11.52.178 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18385 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18978
79.172.77.14 - - [04/Feb/2009:17:32:48 +0200] "GET / HTTP/1.1" 200 18346 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18939

paix · Непрочитанное сообщение **paix** » 2009-02-04 18:40:56

Volodymyr писал(а): Щас отрублю все хосты и по одному повключаю.

елки, с тайкой тачкой хоть на луну лети, а у вас ла под 20

для начала посмотрите httpd-status апача, чтобы увидеть чем он занимается и кто создает оверхеад.

Код: Выделить всё

ExtendedStatus On
<Location /httpd-status>
SetHandler server-status
Order deny,allow
Allow from all
</Location>

ProFTP · Непрочитанное сообщение **ProFTP** » 2009-02-04 18:43:34

mod_dosevinse

я бы банил того кто подключется из динамических/черныйх сетей и который генерит много подключений за день (не бот)... 10000 конектов

вирус или бот капку может перебирать

paix · Непрочитанное сообщение **paix** » 2009-02-04 18:48:19

Volodymyr писал(а):Из 31 хостов на один валится вот такое добро. Если его отключаю сервер работает нормально. Общего: запрос на / клиент ОС Windows NT 5.1; U; ru
Код: Выделить всё
79.172.77.14 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18394 "-" "Opera/9.02 (Windows NT 5.1; U; ru)" 147 18987
190.138.146.33 - - [04/Feb/2009:17:32:45 +0200] "GET / HTTP/1.1" 200 18361 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18954
201.11.52.178 - - [04/Feb/2009:17:32:46 +0200] "GET / HTTP/1.1" 200 18372 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1" 200 18965

очень похоже на дос.
Если домен не сильно важен, то прикройте его временно, чтобы апач отдавал легкий ответ, типа форбиден.

Если важен, то действия комплексны.
1) nginx на фронтенд, - апач бекенд (опционально, но рекомендуется.)
2) скрипты анализа логов и добавления айпишников ботов в таблицу фаера.

ProFTP · Непрочитанное сообщение **ProFTP** » 2009-02-04 18:48:46

Volodymyr писал(а):
Raven2000 писал(а):Думаю что это не трабл апача, а какого-то сайта который зажирает все что может.
Я бы с таким кол-вом серверов все перевел бы на fast-cgi и подрезал бы php.ini каждому.
Я cgi не использую вообще, только рнр как модуль апача.

php можно перевести из mod_php в режим FastCGI не изменяя исходный код пхп программы...

там можно прибивать динамические процессы, допусим который висят более 60 сек., но mod_php тоже можно прибивать.... скриптом

paix · Непрочитанное сообщение **paix** » 2009-02-04 18:52:09

ProFTP писал(а): php можно перевести из mod_php в режим FastCGI не изменяя исходный код пхп программы...
там можно прибивать динамические процессы, допусим который висят более 60 сек., но mod_php тоже можно прибивать.... скриптом

mod_fastcgi от доса никак не спасет вообще!
60 секунд процессорного времени это очень очень много!

вообще фастцжи имеет тенденцию отпадать и отмирать, в результате чего приходится шаманить с kill -9

+ mod_dosevasive как советовали выше, немного помогает.

Volodymyr

Код: Выделить всё

ExtendedStatus On
<Location /httpd-status>
SetHandler server-status
Order deny,allow
Allow from all
</Location>

Добавил это в конфиг, что и где смотреть. И что должен увидеть.

paix · Непрочитанное сообщение **paix** » 2009-02-04 19:01:32

Volodymyr писал(а):
Код: Выделить всё
ExtendedStatus On
<Location /httpd-status>
SetHandler server-status
Order deny,allow
Allow from all
</Location>
Добавил это в конфиг, что и где смотреть. И что должен увидеть.

http://server IP/httpd-status

paix · Непрочитанное сообщение **paix** » 2009-02-04 19:03:27

server-status очень помогает выяснить с каким доменом проблема. В вашем случае это уже не столь актуально, т.к. уже нашли по логам.

так что начинайте внедрять защиты

Volodymyr

Почитал: http://httpd.apache.org/docs/2.2/mod/mod_status.html

Код: Выделить всё

Apache Server Status for ххх.ххх.ххх.ххх

Server Version: Apache/2.2.11 (FreeBSD) mod_ssl/2.2.11 OpenSSL/0.9.8e DAV/2 PHP/5.2.8 with Suhosin-Patch
Server Built: Jan 22 2009 14:31:00

Current Time: Wednesday, 04-Feb-2009 18:03:30 EET
Restart Time: Wednesday, 04-Feb-2009 17:50:39 EET
Parent Server Generation: 1
Server uptime: 12 minutes 51 seconds
Total accesses: 55658 - Total Traffic: 239.4 MB
CPU Usage: u60.4375 s39.2813 cu.03125 cs0 - 12.9% CPU load
72.2 requests/sec - 318.0 kB/second - 4510 B/request
149 requests currently being processed, 0 idle workers

WKKKKKKWKW_K_K_K_KKKWRKWWRKKC_KKKKKW_CW_KWKKWWKWKWKKK.WCKWKWW_KK
KKWKKKWKKKKKWKWC_KKKKKWKKKKKKKRKKK_KWK_WKKWKW_KKKKKWRCKWKCKW___K
WKKWWKKKKWKKWKKKK_WKWK..........................................
................................................................

Scoreboard Key:
"_" Waiting for Connection, "S" Starting up, "R" Reading Request,
"W" Sending Reply, "K" Keepalive (read), "D" DNS Lookup,
"C" Closing connection, "L" Logging, "G" Gracefully finishing,
"I" Idle cleanup of worker, "." Open slot with no current process

Srv	PID	Acc	M	CPU 	SS	Req	Conn	Child	Slot	Client	VHost	Request
0-2	8073	0/17/411	W 	0.12	48	0	0.0	0.09	1.37 	79.172.77.14	******.com.ua	GET / HTTP/1.1

Собствено хост который досят я методым исключения вычислил. Правда с mod_status было бы быстрее. Спасибо.

Volodymyr

Временно вместо защити поменял IP в ДНС атакуемого хоста на 127.0.0.1 (полчаса назад) начало все утихать. Есть время спокойно подумать про защиту.

Куда смотреть в сторону PF ?

forum.lissyara.su

Apache перегружен

Apache перегружен

Услуги хостинговой компании Host-Food.ru

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен

Re: Apache перегружен