Sudden apache problem with many processes

Hello:

I am having a strange issue with Apache 1.3.27 on a Red Hat 7.1
machine. I have this upgraded with the latest updates that were
originally released by Red Hat. It runs about 15 sites that use Perl
and PHP/MySQL mostly. This server has been fine for 5 years, until
recently a few months ago when it got hacked in to and the hackers
gained root access. I have since then cleaned it to the best of my
ability and re-installed the packages that we use, and fixed the
vulnerability. I am not sure if this is related, but recently I have
noticed that the number of Apache processes will increase over time
after the httpd service is started. I have seen as many as 27 httpd
processes running at the same time (after about 12 hours since the
service is restarted) and the physical then swap memory are slowly
eaten up. In the top program, the processes all show a status of "R",
and each one is using around 10 MB of memory, with a time of 13:00 to
as high as 25:00, and the server load increases to 20 up to 40 (until
I restart the httpd service). Every time I restart the httpd service,
things are back to normal for several hours, then it slowly goes back
in to the same state as before where processes start showing up.

Can anybody think of some common things I can check?? I have re-
installed all updated "apache" and "php" packages, as well as all
"mod_..." packages for RH 7.1. I have no idea where to head at this
point. I don't see anything else wrong with the server, it only seems
to be with httpd, there are no hardware errors in /var/log/messages.

Any help or feedback is greatly appreciated. Thank you very much...

--
Chris

Re: Sudden apache problem with many processes

On May 30, 1:51 pm, szilagyic wrote:
> Hello:
>
> I am having a strange issue withApache1.3.27 on a Red Hat 7.1
> machine. I have this upgraded with the latest updates that were
> originally released by Red Hat. It runs about 15 sites that use Perl
> and PHP/MySQL mostly. This server has been fine for 5 years, until
> recently a few months ago when it got hacked in to and the hackers
> gained root access. I have since then cleaned it to the best of my
> ability and re-installed the packages that we use, and fixed the
> vulnerability. I am not sure if this is related, but recently I have
> noticed that the number ofApacheprocesses will increase over time
> after the httpd service is started. I have seen as many as 27 httpd
> processes running at the same time (after about 12 hours since the
> service is restarted) and the physical then swap memory are slowly
> eaten up. In the top program, the processes all show a status of "R",
> and each one is using around 10 MB of memory, with a time of 13:00 to
> as high as 25:00, and the server load increases to 20 up to 40 (until
> I restart the httpd service). Every time I restart the httpd service,
> things are back to normal for several hours, then it slowly goes back
> in to the same state as before where processes start showing up.
>
> Can anybody think of some common things I can check?? I have re-
> installed all updated "apache" and "php" packages, as well as all
> "mod_..." packages for RH 7.1. I have no idea where to head at this
> point. I don't see anything else wrong with the server, it only seems
> to be with httpd, there are no hardware errors in /var/log/messages.
>
> Any help or feedback is greatly appreciated. Thank you very much...
>
> --
> Chris

It looks like I resolved our problem. I believe that the issue was a
site that uses a Postgresql database. While looking for the Apache
problem, I upgraded Postgresql and after restarting that service
noticed two "postmaster" processes running, one of which taking 100%
of the CPU. After I killed all of the postmaster processes and
started the Postgresql service back up, everything has been running
smooth.