we have a shared web server and occasionally our nagios monitor will alert a "bad apache process." not at any regular interval or time, all completely random times. there is not pattern to when it happens.

i check the ps output for apache and i see it's running "crond"

before i can really devote time to how and why, the process stops, it's usually 5-10 minutes in duration.

are there any tips to troubleshooting this?

This looked helpful http://serverfault.com/questions/197...ses-after-post

1 members found this post helpful.

thank you, that has some good ideas and i'll definitely be able to strace the pid when it's running to get more info.

i guess what i should have asked was are there good ways to troubleshoot it when it's not actively running? for example, this morning at 4 it ran for 6 minutes and before i could fire up my computer to login and check it out, it was over.

is there a way i can capture this activity so i can review it in a history format?

i checked our apache logs, looking at the timestamp this started, as well as a minute before it started, but couldn't find anything out of the ordinary that would fire off apache and this crond command.

I use apache at work but I'm not an expert at troubleshooting. I did however find too really good posts that might help.

http://serverfault.com/questions/415...oads-of-memory

https://www.linode.com/docs/troubles...-apache-issues

It sounds like an outside connection is causing the problem. I would make my logs verbose and turn on debugging. You could also get a pcap of the network and analyze the connections to and from the server.

1 members found this post helpful.