[WBEL-users] DOS attack on Apache?

[Benedikt Carda]

Dear All,

I am running WBEL 3 including Apache  on a box. Since four days as soon 
as I turn on Apache it reaches the maximum number of child processes in 
just a few seconds. Accessing a website on the server is awefully slow. 
I looked into the logs and found out, that many people try to reach a 
certain URL on the server (on one virtual host). First I renamed the 
directory to another name and the problem was solved. But the requests 
came back for another directory after a day. I tried to rename this one 
too, but unfortunately this time it did not work. The requests still 
produce the reach of the maximum number of child processes.

It seems that somehow the child processes do not exit after fullfilling 
the request. I tried the following:

* Disconnect from internet, restart Apache
Result: Normal operations, nothing special
* Reconnect to the internet:
Result: A few seconds and maximum number of child processes was reached
* Disconnect again from internet, not restarting Apache
Result: Still the child processes did not exit

Also when restarting the Apache server I get a whole bunch of these kind 
of entries in the error log:

[Mon Jun 20 08:32:21 2005] [warn] child process 975 still did not exit, 
sending a SIGTERM

Does anybody know what to do? Thanks for help in advance.

Best Regards,
Benedikt.