Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a webserver setup to provide vhost-based web hosting for a bunch of domains, and has been working fine for a while. The server is running Ubuntu with Apache. PHP is running as FastCGI and not an Apache module.

Since Sunday morning the apache2 process will occassionally hit 100% CPU utilisation and stick there, no longer serving any requests until it is reset. A simple restart of apache resolves the problem.

All the sites are set up to use FastCGI for the PHP interpreter, so the most obivous source of the problem that I suspected (bad PHP scripts) should've resulted in php5-cgi capping the CPU, not apache2, right?

Is there anything that can be done to interrogate the apache2 process in some way, to see what it is doing at this point?

Simple web-log investigations don't show any suspicious activity or ramping request-flooding.

Bit stumped - currently just running a monitoring script that checks for a rampant apache2 process and restarts it if found.


The process pegged 100% again this morning, and a quick strace -f -p [pid] resulted in the following output. These 6 lines repeat as fast as the screen will scroll.

wait4(3437, 0x7fffaf867184, WNOHANG|WSTOPPED, NULL) = 0
wait4(5497, 0x7fffaf867184, WNOHANG|WSTOPPED, NULL) = 0
wait4(5504, 0x7fffaf867184, WNOHANG|WSTOPPED, NULL) = 0
wait4(3436, 0x7fffaf867184, WNOHANG|WSTOPPED, NULL) = 0
wait4(4035, 0x7fffaf867184, WNOHANG|WSTOPPED, NULL) = 0
wait4(3437, 0x7fffaf867184, WNOHANG|WSTOPPED, NULL) = 0
share|improve this question

You can try attaching to the rogue process using strace:

strace -f -p [PID]

This will show you which syscalls the process is making, if any. Do note that the process may not be wasting its CPU time in syscalls but performing actual in-process work instead, but if the process entered a loop that involves a syscall someplace this will give you valuable information.

share|improve this answer
Thanks. That sounds like it could at least give me a clue! – Cylindric Jun 3 '11 at 15:56
I ran the strace, and have posted my results in the question above. – Cylindric Jun 7 '11 at 8:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.