My question is threefold:
1) how can I figure out what actually happened here,
2) how do I prevent it from happening again, and
3) can I configure Monit to detect and restart the server if it happens again?
Here's what happened:
My apache2 server hosted on an Ubuntu 9.10 RackSpace Cloud Server was down this morning -- and a restart failed [yes, I should have done a start instead -- but as restart falls back to start if there is no server to stop, it shouldn't matter] as follows:
user@host: sudo /etc/init.d/apache2 restart
* Restarting web server apache2
(13)Permission denied: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
google to the rescue: I follow instructions in this post http://www.linuxquestions.org/questions/linux-newbie-8/could-not-bind-to-address-0-0-0-0-80-a-405377/#post3516504
for i in `ps auwx | grep -i nobody | awk {'print $2'}`; do kill -9 $i; done
and it starts without error. So, now I'm fixed, but need to know more.
edit: just saw this: Apache2 falling over -- hope it's not the same thing.
edit: so far, so good -- the rootkit check turns up clean --