> Was it just an IP exhausting the apache service with too many connections? What do you see in the access logs? I use OSSEC HIDS on my apache servers to mitigate this. In the access log I see the same IP made many requests during the service interruption and I think that exhausted the apache service. It looks like there isn't a Gentoo ebuild for OSSEC HIDS. Is there another way to prevent this sort of thing? - Grant >>> My server has 4GB RAM and uses nginx as a reverse proxy to apache. A >>> little while ago my website became inaccessible for about 30 minutes. >>> I checked my munin graphs and it looks like apache processes spiked to >>> about 29 during this time which is many times greater than usual. I >>> have MaxClients at 30 and the error log verifies that MaxClients was >>> not reached. The strange part is system disk latency shows a spike >>> during the interruption which is only very slightly greater than other >>> spikes which did not interrupt service. System CPU, memory, and swap >>> usage don't show anything interesting at all. >>> >>> Does this make sense to anyone? Should I decrease MaxClients? >>> >>> - Grant >> >>I've looked over my access_log and I can see there is a particular IP >>which was making many requests during the interruption. Since munin >>does not show there was an excessive amount of memory or CPU usage, >>lowering MaxClients won't help? >> >>- Grant --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|