Was it just an IP exhausting the apache service with too many connections? What do you see in the access logs? I use OSSEC HIDS on my apache servers to mitigate this. -- Sent from my mobile device Michael D. Wood www.itsecuritypros.org Grant <emailgrant@xxxxxxxxx> wrote: >> My server has 4GB RAM and uses nginx as a reverse proxy to apache. A >> little while ago my website became inaccessible for about 30 minutes. >> I checked my munin graphs and it looks like apache processes spiked to >> about 29 during this time which is many times greater than usual. I >> have MaxClients at 30 and the error log verifies that MaxClients was >> not reached. The strange part is system disk latency shows a spike >> during the interruption which is only very slightly greater than other >> spikes which did not interrupt service. System CPU, memory, and swap >> usage don't show anything interesting at all. >> >> Does this make sense to anyone? Should I decrease MaxClients? >> >> - Grant > >I've looked over my access_log and I can see there is a particular IP >which was making many requests during the interruption. Since munin >does not show there was an excessive amount of memory or CPU usage, >lowering MaxClients won't help? > >- Grant > >--------------------------------------------------------------------- >To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx >For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx > --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|