[WBEL-users] DOS attack on Apache?

[Benedikt Carda]

I have deactivated the CGI module and also all but one virtualhosts (on 
the one still active there are no scripts running) but the problem 
persists. Therefore I think the problem does not come from a runaway 
script. Any further ideas?

Thanks,
Benedikt.


Lem Tomas wrote:

> runaway script?
>
> Benedikt Carda wrote:
>
>> Dear All,
>>
>> me again. I have found out, that it does not seem to be a DOS attack 
>> against HTTP. The requested files and directories are too different 
>> (including different virtual hosts, etc.) to be an attack. 
>> Furthermore the log entries show, that only a few request come. 
>> Therefore, the actual problem is, that a child process does not kill 
>> itself after fulfilling the request. Therefore the max child requests 
>> limit is reached after just 10 to 15 seconds and Apache does not 
>> deliver any more documents. How can this happen and how can I get 
>> Apache to work again?
>>
>> Best Regards,
>> Benedikt.
>>
>>
>> Benedikt Carda wrote:
>>
>>> Dear All,
>>>
>>> I am running WBEL 3 including Apache  on a box. Since four days as 
>>> soon as I turn on Apache it reaches the maximum number of child 
>>> processes in just a few seconds. Accessing a website on the server 
>>> is awefully slow. I looked into the logs and found out, that many 
>>> people try to reach a certain URL on the server (on one virtual 
>>> host). First I renamed the directory to another name and the problem 
>>> was solved. But the requests came back for another directory after a 
>>> day. I tried to rename this one too, but unfortunately this time it 
>>> did not work. The requests still produce the reach of the maximum 
>>> number of child processes.
>>>
>>> It seems that somehow the child processes do not exit after 
>>> fullfilling the request. I tried the following:
>>>
>>> * Disconnect from internet, restart Apache
>>> Result: Normal operations, nothing special
>>> * Reconnect to the internet:
>>> Result: A few seconds and maximum number of child processes was reached
>>> * Disconnect again from internet, not restarting Apache
>>> Result: Still the child processes did not exit
>>>
>>> Also when restarting the Apache server I get a whole bunch of these 
>>> kind of entries in the error log:
>>>
>>> [Mon Jun 20 08:32:21 2005] [warn] child process 975 still did not 
>>> exit, sending a SIGTERM
>>>
>>> Does anybody know what to do? Thanks for help in advance.
>>>
>>> Best Regards,
>>> Benedikt.
>>
>>