You can check /var/log/messege. If your kernel open the syn-cookie, you will be notice when the dos happens. 2006/2/8, dan+apache-list@xxxxxxxxxxxxxxx <dan+apache-list@xxxxxxxxxxxxxxx>: > We are using Apache 2.0.54 on Debian GNU/Linux (standard Debian > packages). The server had been running for several months with > absolutely no problems. A couple of days ago, Apache started slowing > down, then would eventually stop responding completely. The only way > to fix it was to restart Apache. It got to the point that Apache > would only stay functional for a few seconds at a time. Watching the > Apache logs revealed no unusual activity before the lockup. > > I discovered the MaxClients setting, which in Debian defaults to 20 > for the prefork MPM. I raised it to 100, and the problem went away. I > believe the default for this value is normally 256. > > What would cause this problem all of the sudden? My first thought was > a DOS attack. Am I on the right track? > > --df > > > --------------------------------------------------------------------- > The official User-To-User support forum of the Apache HTTP Server Project. > See <URL:http://httpd.apache.org/userslist.html> for more info. > To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx > " from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx > For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx > >
|