Re: Runaway Apache Process

[Dan Bunyard <danodemano@xxxxxxxxx>]

@Jeff
The last request made before it goes out of control doesn't seem to be unique in any way, it appears to be the Yandex spider just crawling one of the sites:
87.250.252.242 - - [25/Jan/2010:11:38:00 -0500] "GET / HTTP/1.1" 301 359 "-" "Yandex/1.01.001 (compatible; Win16; I)"

That was the very last request made before the Apache process went haywire.  I don't see anything unique about that hit, I see a fair number of hits from the same bot on a daily basis.  If you look through the zip I attached earlier the entire access_log and error_log are there.  Nothing stood out to me, though I'm no expert.

Thanks,
--
Dan

http://www.moonlightrpg.com
http://www.linkedin.com/in/danbunyard
http://www.danodemano.com

http://www.dansrandomness.com
http://www.danandshelley.com

This is not a problem that requires infinite wisdom, Benj. This is a problem that requires enough neural organization to qualify as a vertebrate, apparently a stretch for some folks these days.

~Cecil Adams.

On Wed, Jan 27, 2010 at 08:52, Jeff Trawick <trawick@xxxxxxxxx> wrote:

On Wed, Jan 27, 2010 at 8:46 AM, Dan Bunyard <danodemano@xxxxxxxxx> wrote:
> @Mark
> I will do that the next time it happens.  I will also trim down the modules,
> I think I had done a mass install of a bunch of things I needed but in the
> process picked up a lot of them that I don't/won't use.

That's a good suggestion and should be followed, but relative to this
problem symptom: I don't think that will help memory consumption much
on Linux.  There's only one copy of the code in memory, none allocated
from swap, and modules rarely use that much heap unless they've been
configured

>
> @Jeff
> I will try that as well.  I'm unsure how to do a strace either to be
> honest.

sudo strace -o /tmp/tracefile -p PID
where PID is one of the high CPU httpd processes you picked at random
(run top, see which ones have high CPU)

>          I can't imagine this is from shear number of requests.  In the hour
> or so leading up to the event there are only 123 GET requests logged in the
> access_log file.  That just about one every 30 seconds, I can't see that
> being a problem.

Are they different requests at the time of the problem symptom perhaps?
Otherwise, something "goes bad" and the app starts malfunctioning from then on.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
  "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx