 | | | Apache looping? | Apache looping? 2006-07-12 - By Stephen John Smoogen
Back
On 7/12/06, Collins, Kevin [MindWorks] <KCollins@(protected)> wrote:
>
>
>
> Hi folks,
>
> I've discovered this morning that one of my web servers was
> unresponsive. I check with a 'ps -ef' and discovered I had only one httpd
> process (the parent, running as root). So, I restarted Apache with 'service
> httpd restart' and see the same behavior - parent is started with no
> children. The access.log and error.log appear normal.
>
My first look would be to see what has changed in /etc and /var in the
last 8-10 days (or however long ago it was working.) A lock file that
can't be removed for some odd reason etc. It can be something silly
like Asst Admin C forgot to tell Admin A that he put out a new
nsswitch.conf and ldap which was for a test network, and httpd is
waiting to find some UID:GID entry in the ldap server.
If Nothing has changed.. I would first suspect hardware problems
(memory,disk) and then root-kit issues.
I would first do a check of the system logs for any memory issues
being reported or hardware crapping out. Then I would boot with a
livecd and run a memory checker and then a chkrootkit.
If those come up clear, I would go for an strace of httpd being
started up to see where it starts trying to time out. Look in top or
ps to see if the httpd process is in device wait... waiting for
something to become free (an NFS mount lets say).
> Nothing has changed on this server in months and I can confirm via the
> previous access logs that it was responsive a couple days ago.
>
> If I use 'strace' to attach to the running parent process I see this:
>
--
Stephen J Smoogen.
CSIRT/Linux System Administrator
--
Taroon-list mailing list
Taroon-list@(protected)
https://www.redhat.com/mailman/listinfo/taroon-list
|
|
|