large amount of R in server-status

--0016e6d58f7f071fb10480d0100c
Content-Type: text/plain; charset=UTF-8

Hi,

I use since long time the apache in version 2.0 on windows 2000 (SP4).
Since 4 weeks I can see (some times per day) many R in server-status.
Sometimes so much that the server run full and stop working because all
threads are used. I search in web and generally the response is that it have
to do with dos but I'm not sure (or can't believe that)

When I watch over some time the serverstatus I can see sometimes requests
staying in R status until the configparameter timeout=300 (default) kick the
request out. Sometimes this R staying requests use more then 50% from my
threads and then after timeout all works like expexcted. Sometimes the
complete webserver is blocked.

Current I have 450 threads on apache and in background 2 clustered tomcats
with a 200 threads.

Can anybody explain me how it is possible that some (?) can send a rq to a
webserver and don't finish the rq that the server wait for it? How can I
solve such situations?

Further: how can I identify and/or analyze a problem like this. I have now a
situation where I have log the network trafik with wireshark.

This problem start (about) at a time when we switch to a new provider.

I have now version 2.0.57 but I have the problem also in the latest version
from the 2.0 tree.

If someone has some hint and or experience how to identify the problem -->
thanks for any comment / hint

regards Dietmar

--0016e6d58f7f071fb10480d0100c
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi,

I use since long time the apache in version 2.0 on windows 2000 =
(SP4).
Since 4 weeks I can see (some times per day) many R in server-sta=
tus. Sometimes so much that the server run full and stop working because al=
l threads are used. I search in web and generally the response is that it h=
ave to do with dos but I'm not sure (or can't believe that)


When I watch over some time the serverstatus I can see sometimes reques=
ts staying in R status until the configparameter timeout=3D300 (default) ki=
ck the request out. Sometimes this R staying requests use more then 50% fro=
m my threads and then after timeout all works like expexcted. Sometimes the=
complete webserver is blocked.


Current I have 450 threads on apache and in background 2 clustered tomc=
ats with a 200 threads.

Can anybody explain me how it is possible th=
at some (?) can send a rq to a webserver and don't finish the rq that t=
he server wait for it? How can I solve such situations?


Further: how can I identify and/or analyze a problem like this. I have =
now a situation where I have log the network trafik with wireshark.

=
This problem start (about) at a time when we switch to a new provider.


I have now version 2.0.57 but I have the problem also in the latest ver=
sion from the 2.0 tree.

If someone has some hint and or experience h=
ow to identify the problem --> thanks for any comment / hint


regards Dietmar


--0016e6d58f7f071fb10480d0100c--

Re: large amount of R in server-status

--00163642652358fe400481974ddf
Content-Type: text/plain; charset=UTF-8

> Hi,
>
> I use since long time the apache in version 2.0 on windows 2000 (SP4).
> Since 4 weeks I can see (some times per day) many R in server-status.
> Sometimes so much that the server run full and stop working because all
> threads are used. I search in web and generally the response is that it have
> to do with dos but I'm not sure (or can't believe that)
>
> When I watch over some time the serverstatus I can see sometimes requests
> staying in R status until the configparameter timeout=300 (default) kick the
> request out. Sometimes this R staying requests use more then 50% from my
> reads and then after timeout all works like expexcted. Sometimes the
> complete webserver is blocked.
>
> Current I have 450 threads on apache and in background 2 clustered tomcats
> with a 200 threads.
>
> Can anybody explain me how it is possible that some (?) can send a rq to a
> webserver and don't finish the rq that the server wait for it? How can I
> solve such situations?
>
> Further: how can I identify and/or analyze a problem like this. I have now a
> situation where I have log the network trafik with wireshark.
>
> This problem start (about) at a time when we switch to a new provider.
>
> I have now version 2.0.57 but I have the problem also in the latest version
> from the 2.0 tree.
>
> If someone has some hint and or experience how to identify the problem -->
> thanks for any comment / hint
>
> regards Dietmar

Hi,
I found the problem :-)

http://ha.ckers.org/slowloris

/* for the archive */
to isolate the problem I write a small script which store every sec netstat -na
and the after analyze it and search some hours in web I found the problem.

Might after migration to an other os follow mod is a solution:
http://mod-qos.sourceforge.net/

hope this help other people!

If someone have any input about this pls let me know

regards Dietmar

--00163642652358fe400481974ddf
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

> Hi,
> 
> I use since long time the apache in version =

2.0 on windows 2000 (SP4).
> Since 4 weeks I can see (some times per =

day) many R in server-status.
> Sometimes so much that the server run=

 full and stop working because all


> threads are used. I search in web and generally the response is that i=

t have
> to do with dos but I'm not sure (or can't believe th=

at)
>  
> When I watch over some time the serverstatus I can se=

e sometimes requests


> staying in R status until the configparameter timeout=3D300 (default) =

kick the
> request out. Sometimes this R staying requests use more th=

en 50% from my
> reads and then after timeout all works like expexcte=

d. Sometimes the


> complete webserver is blocked.
> 
> Current I have 450 thr=

eads on apache and in background 2 clustered tomcats
> with a 200 thr=

eads.
> 
> Can anybody explain me how it is possible that some =

(?) can send a rq to a


> webserver and don't finish the rq that the server wait for it? How=

 can I
> solve such situations?
> 
> Further: how can I i=

dentify and/or analyze a problem like this. I have now a
> situation =

where I have log the network trafik with wireshark.


> 
> This problem start (about) at a time when we switch to a new =

provider.
> 
> I have now version 2.0.57 but I have the problem=

 also in the latest version
> from the 2.0 tree.
> 
> If =

someone has some hint and or experience how to identify the problem --><=

br>

> thanks for any comment / hint
> 
> regards Dietmar

=

Hi,
I found the problem :-)


ris">http://ha.ckers.org/slowloris

/* for the archive */
to i=

solate the problem I write a small script which store every sec netstat -na=




and the after analyze it and search some hours in web I found the problem.<=

br>
Might after migration to an other os follow mod is a solution:

 href=3D"http://mod-qos.sourceforge.net/">http://mod-qos.sourceforge.net/
a>



hope this help other people!

If someone have any input about thi=

s pls let me know

regards Dietmar

Re: Re: large amount of R in server-status

Dietmar Müller schrieb:
>> Hi,
>>
>> I use since long time the apache in version 2.0 on windows 2000 (SP4).
>> Since 4 weeks I can see (some times per day) many R in server-status.
>> Sometimes so much that the server run full and stop working because all
>
>> threads are used. I search in web and generally the response is that it have
>> to do with dos but I'm not sure (or can't believe that)
>>
>> When I watch over some time the serverstatus I can see sometimes requests
>
>> staying in R status until the configparameter timeout=300 (default) kick the
>> request out. Sometimes this R staying requests use more then 50% from my
>> reads and then after timeout all works like expexcted. Sometimes the
>
>> complete webserver is blocked.
>>
>> Current I have 450 threads on apache and in background 2 clustered tomcats
>> with a 200 threads.
>>
>> Can anybody explain me how it is possible that some (?) can send a rq to a
>
>> webserver and don't finish the rq that the server wait for it? How can I
>> solve such situations?
>>
>> Further: how can I identify and/or analyze a problem like this. I have now a
>> situation where I have log the network trafik with wireshark.
>
>>
>> This problem start (about) at a time when we switch to a new provider.
>>
>> I have now version 2.0.57 but I have the problem also in the latest version
>> from the 2.0 tree.
>>
>> If someone has some hint and or experience how to identify the problem -->
>
>> thanks for any comment / hint
>>
>> regards Dietmar
>
> Hi,
> I found the problem :-)
>
> http://ha.ckers.org/slowloris
>
> /* for the archive */
> to isolate the problem I write a small script which store every sec netstat -na
>
> and the after analyze it and search some hours in web I found the problem.
>
> Might after migration to an other os follow mod is a solution:
> http://mod-qos.sourceforge.net/
>
>
> hope this help other people!
>
> If someone have any input about this pls let me know
>
> regards Dietmar
>

And what is the root of your problem ?

regards

Hendrik


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Re: large amount of R in server-status

--0016e6d99d7e3d8546048197d365
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

2010/3/12 Hendrik Schmieder

> Dietmar Müller schrieb:
>
> Hi,
>>>
>>> I use since long time the apache in version 2.0 on windows 2000 (SP4).
>>> Since 4 weeks I can see (some times per day) many R in server-status.
>>> Sometimes so much that the server run full and stop working because al=
l
>>>
>>
>> threads are used. I search in web and generally the response is that i=
t
>>> have
>>> to do with dos but I'm not sure (or can't believe that)
>>>
>>> When I watch over some time the serverstatus I can see sometimes
>>> requests
>>>
>>
>> staying in R status until the configparameter timeout=3D300 (default) =
kick
>>> the
>>> request out. Sometimes this R staying requests use more then 50% from =
my
>>> reads and then after timeout all works like expexcted. Sometimes the
>>>
>>
>> complete webserver is blocked.
>>>
>>> Current I have 450 threads on apache and in background 2 clustered
>>> tomcats
>>> with a 200 threads.
>>>
>>> Can anybody explain me how it is possible that some (?) can send a rq =
to
>>> a
>>>
>>
>> webserver and don't finish the rq that the server wait for it? How can=
I
>>> solve such situations?
>>>
>>> Further: how can I identify and/or analyze a problem like this. I have
>>> now a
>>> situation where I have log the network trafik with wireshark.
>>>
>>
>>
>>> This problem start (about) at a time when we switch to a new provider.
>>>
>>> I have now version 2.0.57 but I have the problem also in the latest
>>> version
>>> from the 2.0 tree.
>>>
>>> If someone has some hint and or experience how to identify the problem
>>> -->
>>>
>>
>> thanks for any comment / hint
>>>
>>> regards Dietmar
>>>
>>
>> Hi,
>> I found the problem :-)
>>
>> http://ha.ckers.org/slowloris
>>
>> /* for the archive */
>> to isolate the problem I write a small script which store every sec
>> netstat -na
>>
>> and the after analyze it and search some hours in web I found the proble=
m.
>>
>> Might after migration to an other os follow mod is a solution:
>> http://mod-qos.sourceforge.net/
>>
>>
>> hope this help other people!
>>
>> If someone have any input about this pls let me know
>>
>> regards Dietmar
>>
>>
> And what is the root of your problem ?
>
> regards
>
> Hendrik
>
>
The root problem is, that the apache webserver is susceptible for a small
perl script what send incomplete / slow http requests and this cause that
all threads from the httpd are in reading state.

Dietmar

--0016e6d99d7e3d8546048197d365
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable