Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

My Freebsd server got many DoS attacks recently, which caused Apache or Mysql to stop serving normal connections. When mysql reached its max connections, my application will send me an email about each mysql error, so I can block evil IPs. But when Apache refuses connections, I wouldn't know about it unless I'm visiting the site myself. Is it possible to know when Apache reaches its max connections? So that I can tune Apache or block malicious IPs? Thanks!

share|improve this question

3 Answers

up vote 3 down vote

Well, the general solution would be to add some external monitoring.

One approach might be to run your own Nagios server. There is definitely some effort in setting it up, but on the other hand it will also allow you to do all kinds of monitoring.

A perhaps easier solution would be to use some third party monitoring service such as was it up? or pingdom.

In addition to making sure your server response to http it's a good thing to also verify that the response page contain some expected phrase or so. That way you get some verification on that also the underlaying application layer is somewhat working.

share|improve this answer
Thanks! I'm using a third party monitor, but it's more helpful to detect when server is down, attacks rarely bring my server down after I tuned mysql, they usually last 5~15 minutes. <br /><br /> I expect Apache will trigger some event (send root an mail for example) when it start refusing connections. Or some on-site monitor that are more intuitive, for example, an application would send me an email like "IP x.x.x.x has requested 1000 pages in the past 5 minutes, you might what to do something...." :-) – lastsmoke Jul 28 '11 at 3:21
Just checked out wasitup, it's great and would work well together with my paid monitor service that doesn't check response content but sends sms alerts. Cheers! – lastsmoke Jul 28 '11 at 3:32
Well, how Apache behaves depends on how well you have tuned your MPM settings. Either it will start refusing connections and complain about MaxClients in its log files, or it will simply run up an insane load, possibly combined with heavy swapping. In case of high load it might not even be able to sent the notifications itself until the problem is over. While tuning MPM settings is a good thing it is far from trivial to get perfect, given that certain pages/urls might be significantly heavier than the average. – andol Jul 31 '11 at 13:02
up vote 0 down vote

I believe that mod_status will be able to give you the info you need, though it won't be as useful if Apache is refusing connections: http://httpd.apache.org/docs/2.2/mod/mod_status.html

Apachetop should also be able to tell you the current number of connections. It's available in most repositories.

The best way, however, may be just to script a wget call to the site and automatically dump relevant log data if it fails two checks in a short (5-10sec) period.

share|improve this answer
up vote 0 down vote 
~# curl -sIL localhost
HTTP/1.1 200 OK
Date: Mon, 29 Aug 2011 03:28:42 GMT
Server: Apache/2.2.16 (Debian)
Last-Modified: Mon, 18 Jul 2011 22:20:41 GMT
ETag: "f902-b1-4a85f68d52040"
Accept-Ranges: bytes
Content-Length: 177
Vary: Accept-Encoding
Content-Type: text/html

~# echo $?
0
~# cat >mycheck.sh
#!/bin/bash
curl -sIL localhost 2>&1 >/dev/null   
if [ $? -eq 0 ]; then
    echo " Success !"
else
    echo " FAIL "
fi
CTRL^D
~# sh mycheck.sh 
 Success !
~# iptables -I INPUT -p tcp --dport 80 -j DROP
~# sh mycheck.sh 
 FAIL
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.