Hi,
3 Days ago everything was fine, but now the apache2 is acting very strange.
doing a " ps -A " shows like 100+ apache2 process.
I did update plesk to 8.6.0 and it kinda started happening after that,
i looked up on support fourm and no such issue.
Don't use any SSL or stuff on site.
Server is a Debian Etch.
After that I ran a apt-get upgrade.
It updated some stuff
I hope the below might be helpful too.
Code:
The following packages have been kept back:
libmozjs0d libxul-common libxul0d linux-image-2.6-686
linux-image-2.6-686-bigmem openssh-client openssh-server
xulrunner-gnome-support
Apache2 access log: (its filled with the gibberish below and contains like over 20K lines of that)
Code:
::1 - - [10/Sep/2008:08:45:38 +0200] "GET / HTTP/1.0" 302 468 "-" "Apache/2.2.3 (Debian) mod_jk/1.2.18 mod_python/3.2.10 Python/2.4.4 PHP/4.4.4-8+etch6 mod_ssl/2.2.3 OpenSSL/0.9.8c mod_perl/2.0.2 Perl/v5.8.8 (internal dummy connection)"
::1 - - [10/Sep/2008:08:45:39 +0200] "GET / HTTP/1.0" 302 468 "-" "Apache/2.2.3 (Debian) mod_jk/1.2.18 mod_python/3.2.10 Python/2.4.4 PHP/4.4.4-8+etch6 mod_ssl/2.2.3 OpenSSL/0.9.8c mod_perl/2.0.2 Perl/v5.8.8 (internal dummy connection)"
::1 - - [10/Sep/2008:08:45:57 +0200] "GET / HTTP/1.0" 302 468 "-" "Apache/2.2.3 (Debian) mod_jk/1.2.18 mod_python/3.2.10 Python/2.4.4 PHP/4.4.4-8+etch6 mod_ssl/2.2.3 OpenSSL/0.9.8c mod_perl/2.0.2 Perl/v5.8.8 (internal dummy connection)"
::1 - - [10/Sep/2008:08:46:00 +0200] "GET / HTTP/1.0" 302 468 "-" "Apache/2.2.3 (Debian) mod_jk/1.2.18 mod_python/3.2.10 Python/2.4.4 PHP/4.4.4-8+etch6 mod_ssl/2.2.3 OpenSSL/0.9.8c mod_perl/2.0.2 Perl/v5.8.8 (internal dummy connection)"
::1 - - [10/Sep/2008:08:46:01 +0200] "GET / HTTP/1.0" 302 468 "-" "Apache/2.2.3 (Debian) mod_jk/1.2.18 mod_python/3.2.10 Python/2.4.4 PHP/4.4.4-8+etch6 mod_ssl/2.2.3 OpenSSL/0.9.8c mod_perl/2.0.2 Perl/v5.8.8 (internal dummy connection)"
::1 - - [10/Sep/2008:08:46:11 +0200] "GET / HTTP/1.0" 302 468 "-" "Apache/2.2.3 (Debian) mod_jk/1.2.18 mod_python/3.2.10 Python/2.4.4 PHP/4.4.4-8+etch6 mod_ssl/2.2.3 OpenSSL/0.9.8c mod_perl/2.0.2 Perl/v5.8.8 (internal dummy connection)"
::1 - - [10/Sep/2008:08:46:17 +0200] "GET / HTTP/1.0" 302 468 "-" "Apache/2.2.3 (Debian) mod_jk/1.2.18 mod_python/3.2.10 Python/2.4.4 PHP/4.4.4-8+etch6 mod_ssl/2.2.3 OpenSSL/0.9.8c mod_perl/2.0.2 Perl/v5.8.8 (internal dummy connection)"
::1 - - [10/Sep/2008:08:46:18 +0200] "GET / HTTP/1.0" 302 468 "-" "Apache/2.2.3 (Debian) mod_jk/1.2.18 mod_python/3.2.10 Python/2.4.4 PHP/4.4.4-8+etch6 mod_ssl/2.2.3 OpenSSL/0.9.8c mod_perl/2.0.2 Perl/v5.8.8 (internal dummy connection)"
::1 - - [10/Sep/2008:08:46:40 +0200] "GET / HTTP/1.0" 302 468 "-" "Apache/2.2.3 (Debian) mod_jk/1.2.18 mod_python/3.2.10 Python/2.4.4 PHP/4.4.4-8+etch6 mod_ssl/2.2.3 OpenSSL/0.9.8c mod_perl/2.0.2 Perl/v5.8.8 (internal dummy connection)"
The apache2 error log
Code:
[Wed Sep 10 09:53:02 2008] [warn] Init: SSL server IP/port conflict: default-lo-ca-l-ho-st:443 (/etc/apache2/conf.d/zz010_psa_httpd.conf:124) vs. webmail:443 (/etc/apache2/conf.d/zz010_psa_httpd.conf:183)
[Wed Sep 10 09:53:02 2008] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!!
[Wed Sep 10 09:53:02 2008] [notice] suEXEC mechanism enabled (wrapper: /usr/lib/apache2/suexec)
[Wed Sep 10 09:53:02 2008] [notice] mod_python: Creating 8 session mutexes based on 150 max processes and 0 max threads.
[Wed Sep 10 09:53:02 2008] [notice] mod_python: using mutex_directory /tmp
[Wed Sep 10 09:53:02 2008] [warn] RSA server certificate CommonName (CN) `plesk' does NOT match server name!?
[Wed Sep 10 09:53:02 2008] [warn] RSA server certificate CommonName (CN) `plesk' does NOT match server name!?
[Wed Sep 10 09:53:02 2008] [warn] RSA server certificate CommonName (CN) `plesk' does NOT match server name!?
[Wed Sep 10 09:53:02 2008] [warn] RSA server certificate CommonName (CN) `plesk' does NOT match server name!?
[Wed Sep 10 09:53:02 2008] [warn] Init: SSL server IP/port conflict: default-lo-ca-l-ho-st:443 (/etc/apache2/conf.d/zz010_psa_httpd.conf:124) vs. webmail:443 (/etc/apache2/conf.d/zz010_psa_httpd.conf:183)
[Wed Sep 10 09:53:02 2008] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!!
[Wed Sep 10 09:53:02 2008] [notice] mod_bw : Memory Allocated 0 bytes (each conf takes 28 bytes)
[Wed Sep 10 09:53:02 2008] [notice] mod_bw : Version 0.8 - Initialized [0 Confs]
[Wed Sep 10 09:53:02 2008] [notice] Apache/2.2.3 (Debian) mod_jk/1.2.18 mod_python/3.2.10 Python/2.4.4 PHP/4.4.4-8+etch6 mod_ssl/2.2.3 OpenSSL/0.9.8c mod_perl/2.0.2 Perl/v5.8.8 configured -- resuming normal operations
[Wed Sep 10 09:55:07 2008] [error] server reached MaxClients setting, consider raising the MaxClients setting
Bit of apache2.conf
Code:
# prefork MPM
# StartServers: number of server processes to start
# MinSpareServers: minimum number of server processes which are kept spare
# MaxSpareServers: maximum number of server processes which are kept spare
# MaxClients: maximum number of server processes allowed to start
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule mpm_prefork_module>
StartServers 8
MinSpareServers 20
MaxSpareServers 48
MaxClients 150
MaxRequestsPerChild 4
</IfModule>
# worker MPM
# StartServers: initial number of server processes to start
# MaxClients: maximum number of simultaneous client connections
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# ThreadsPerChild: constant number of worker threads in each server process
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule mpm_worker_module>
StartServers 8
MaxClients 150
MinSpareThreads 25
MaxSpareThreads 75
ThreadsPerChild 25
MaxRequestsPerChild 4
</IfModule>
I have a feeling it can also be an attack??
cuz some people always try to keep up with me ( i mean drag me back to keep up )
Please Help!!
