apache is barfing!

sneakyimp · 09-28-2005, 04:19 PM

I've been developing a really large site on a LAMP setup. Last nite at 4AM apache puked and stopped serving pages. then, it stops responding to apachectl commands. Here are the last few entries from the apache log:

Code:

[Tue Sep 27 13:40:53 2005] [notice] httpdmon: httpdmon_init
[Tue Sep 27 13:40:53 2005] [notice] bandwidth monitoring enabled (mapping file: /etc/virtualhosting/mappings/apache.domainmap)
[Tue Sep 27 13:40:54 2005] [notice] Apache configured -- resuming normal operations
exclog: signal received 15
[Wed Sep 28 04:02:18 2005] [notice] SIGHUP received.  Attempting to restart
[Wed Sep 28 04:02:20 2005] [notice] seg fault or similar nasty error detected in the parent process

david_ross · 09-28-2005, 04:28 PM

What apache version are you using?

Is there anything in the access logs to suggest a buffer overflow or other attack?

Do you have snort running?

To get it restarted try making sure it is fully stopped then start it:
killall -9 httpd
apachectl start

sneakyimp · 09-28-2005, 05:28 PM

Code:

Server version: Apache/2.0.50
Server built:   Jul  1 2004 08:49:07

The apache access logs are actually empty from 03:00 until 15:30 today when i discovered the problem. this is really uncommon. we usually have a smattering of traffic all night long.

i think the problem is lack of RAM, but i can't figure it out for sure. The webstats get processed at 4:10 AM and the crash happened shortly after.

Why the SIGHUP? What does that mean? Is that specific to apache or is it a lower level system thing?

dmellem · 09-28-2005, 07:54 PM

I don't know if this is what you're asking, but SIGHUP is the hangup signal and is used to tell the server to reload its configuration file. By default, kill sends SIGTERM to terminate.

-Dan

sneakyimp · 09-28-2005, 08:50 PM

thanks for the info.

when you say 'server to reload the config file' do you mean apache config or the whole box's linux config? what could have caused the SIGHUP?

dmellem · 09-28-2005, 09:28 PM

In this case, it's Apache. You can send several programs that signal to reload their configuration file and continue on. It's usually quicker then restarting the entire application.

kill -HUP <id>
or
killall -HUP <name>

-Dan

deoren · 09-29-2005, 05:46 AM

Perhaps this post will be useful to you:
http://forums.gentoo.org/viewtopic-p...9.html#2744199

david_ross · 09-29-2005, 02:38 PM

The SIGHUP is probably being sent after you do some kind of log rotation I'd guess.