Re: Runaway Apache Process

--001485f86e3a1cdf91047e2624fd
Content-Type: text/plain; charset=UTF-8

@Jeff
The last request made before it goes out of control doesn't seem to be
unique in any way, it appears to be the Yandex spider just crawling one of
the sites:
87.250.252.242 - - [25/Jan/2010:11:38:00 -0500] "GET / HTTP/1.1" 301 359 "-"
"Yandex/1.01.001 (compatible; Win16; I)"
That was the very last request made before the Apache process went haywire.
I don't see anything unique about that hit, I see a fair number of hits from
the same bot on a daily basis. If you look through the zip I attached
earlier the entire access_log and error_log are there. Nothing stood out to
me, though I'm no expert.

Thanks,
--
Dan

http://www.moonlightrpg.com
http://www.linkedin.com/in/danbunyard
http://www.danodemano.com
http://www.dansrandomness.com
http://www.danandshelley.com

This is not a problem that requires infinite wisdom, Benj. This is a problem
that requires enough neural organization to qualify as a vertebrate,
apparently a stretch for some folks these days.
~Cecil Adams.


On Wed, Jan 27, 2010 at 08:52, Jeff Trawick wrote:

> On Wed, Jan 27, 2010 at 8:46 AM, Dan Bunyard wrote:
> > @Mark
> > I will do that the next time it happens. I will also trim down the
> modules,
> > I think I had done a mass install of a bunch of things I needed but in
> the
> > process picked up a lot of them that I don't/won't use.
>
> That's a good suggestion and should be followed, but relative to this
> problem symptom: I don't think that will help memory consumption much
> on Linux. There's only one copy of the code in memory, none allocated
> from swap, and modules rarely use that much heap unless they've been
> configured
> >
> > @Jeff
> > I will try that as well. I'm unsure how to do a strace either to be
> > honest.
>
> sudo strace -o /tmp/tracefile -p PID
> where PID is one of the high CPU httpd processes you picked at random
> (run top, see which ones have high CPU)
>
>
> > I can't imagine this is from shear number of requests. In the
> hour
> > or so leading up to the event there are only 123 GET requests logged in
> the
> > access_log file. That just about one every 30 seconds, I can't see that
> > being a problem.
>
> Are they different requests at the time of the problem symptom perhaps?
> Otherwise, something "goes bad" and the app starts malfunctioning from then
> on.
>
> ------------------------------------------------------------ ---------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>

--001485f86e3a1cdf91047e2624fd
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

@Jeff
The last request made before it goes out of control doesn't se=
em to be unique in any way, it appears to be the Yandex spider just crawlin=
g one of the sites:
87.250.252.242 - - [25/Jan/2010:11:38:00 -0500] &quo=
t;GET / HTTP/1.1" 301 359 "-" "Yandex/1.01.001 (compati=
ble; Win16; I)"


That was the very last request made before the Apache process went haywire.=
  I don't see anything unique about that hit, I see a fair number =
of hits from the same bot on a daily basis.  If you look through the z=
ip I attached earlier the entire access_log and error_log are there.  =
Nothing stood out to me, though I'm no expert.



Thanks,
--
Dan

htrpg.com">http://www.moonlightrpg.com
n.com/in/danbunyard">http://www.linkedin.com/in/danbunyard
=3D"http://www.danodemano.com">http://www.danodemano.com


=

http://www.danandshelley.com a>

This is not a problem that requires infinite wisdom, Benj. This i=
s a problem that requires enough neural organization to qualify as a verteb=
rate, apparently a stretch for some folks these days.


~Cecil Adams.