up vote 1 down vote favorite
share [g+] share [fb]

I don't know what's happening but sometimes (pretty often in these last day) if i try to open my website (that is hosted on a my dedicated server)

the site takes too much time to show up. Then the only solution to recover it is to restart apache with the classic debian command: 

/etc/init.d/apache2 restart

After that my website immediatly show up when I open it in my browser.

I have debian 64 bit with 4GB ram and a Core 2 Duo @ 2.33 GHz

Apache 2 settings are the follow:

Timeout 10
KeepAlive Off
<IfModule mpm_prefork_module>
    StartServers            90
    MinSpareServers         5
    MaxSpareServers         20
    ServerLimit     90
    MaxClients              90
    MaxRequestsPerChild     0
</IfModule>

Error.log shows nothing beside a "[error] favicon.ico not found"

Just after the restart top command is:

top - 17:53:43 up 129 days,  6:06,  1 user,  load average: 0.18, 0.16, 0.18
Tasks: 207 total,   1 running, 206 sleeping,   0 stopped,   0 zombie
Cpu(s): 12.4%us,  2.1%sy,  0.0%ni, 80.4%id,  4.0%wa,  0.0%hi,  1.2%si,  0.0%st
Mem:   4040068k total,  3851432k used,   188636k free,  2037056k buffers
Swap:  1051384k total,     1332k used,  1050052k free,   772836k cached

Please Help me. (and please don't ask me to install mod_status)

I saw /var/log/messages and i found a lot of this meessage, Maybe this is a DDOS attack?

Jan 29 18:31:31 ns354729 kernel: possible SYN flooding on port 80. Sending cookies.
link|improve this question
78% accept rate
3  
Firstly, the output of top before you restart apache - while the problem still exists - would be much more relevant. If you believe you have a syn flooding problem, look into some iptables rulesets that might curtail it. Lastly, you are using about 1.8GB (3.8GB-2GB) of memory right after a restart of Apache - as the apache processes grow, it is possible you run out of memory, if that is the problem, reduce the number of servers running. – cyberx86 Jan 29 at 20:27
feedback

2 Answers

up vote 2 down vote

Setup a automated script to perodically request a page and check to see if the results are valid. combine this with settup up tools like atsar, process accounting, and other things that will capture the state of your system and log it. Once you have an exact failure time try and coorelate that with everything you have logged.

As a temporary measure you might want to also setup monit to monitor, notify you, and automatically restart apache on failure.

link|improve this answer
atsar hmmm should try it... – yes123 Jan 29 at 21:01
feedback
up vote 0 down vote

The first thing I would try is to add this line to /etc/sysctl.conf and restart the box (just to make sure it takes effect): net.ipv4.tcp_max_syn_backlog = 4096

If the SYN flood messages don't stop try increasing this value more.

Linux Kernel Tuning

link|improve this answer
You can have sysctl.conf changes take effect without reboot by running "sudo sysctl -p". You can verify the setting is in effect by doing something like "cat /proc/sys/net/ipv4/tcp_max_syn_backlog", to see if the "4096" value is there. For that matter, "echo 4096 > /proc/sys/net/ipv4/tcp_max_syn_backlog" will set that parameter, if the user is just testing and doesn't want to make changes to sysctl.conf. Of course, the change won't survive a reboot in that case. – cjc Jan 29 at 21:01
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.