Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running a website on a LAMP stack, and new to managing servers. When I run the command top, it lists several users named nobody accessing the command httpd. Does that correspond to the number of visitors currently on my website?

If so, sometimes I have 20 or 30 "nobody"'s accessing my website, each taking a certain % of my memory. As the traffic increases, I will increase my memory, but are there other ways around this problem? (I know it is a broad question, but I need some general advice)


share|improve this question
Oh, don't mind me, I'm just browsing – Kyle Cronin Jul 21 '09 at 0:41

No, top stands for 'table of processes' and will list the processes (running, sleeping, waiting for i/o or otherwise) on your machine. With a typical LAMP setup you will will have a few processes that wait for, accept a connection, processs a request and return to a kind of idle state. Thus, there is no direct correlation to the number of 'active users'.

To properly analyze the load of your apache server, you should use the logs that your apache writes (usually to /var/log/apache, check your config).

Starting points for understanding what is going on might be the apache documentation, and your system manual for top (man top). Detailed insight on what your apache httpd is currently doing can be gained using mod_status, but make sure you protect the status url with a good password.

share|improve this answer
so each of those httpd is for processing a request to pick up a new webpage? – chris Jul 21 '09 at 0:20
That's true. I have updated my answer with information on how to analyze what your apache is doing. – Jan Jungnickel Jul 21 '09 at 0:24
a sidenote: top doesnt show by default threaded processes, each of those httpd's probably have alot of children serving pages. – pauska Jul 21 '09 at 0:40
that will not be the case in typical setups, because mod_php requires a non-threaded mpm. – Jan Jungnickel Jul 21 '09 at 16:44

nobody so far has answered your question about the "nobody" goes:

when top lists the username 'nobody', it has NOTHING at all to do with which user is logged in to your web site.

top doesn't know, doesn't care, and has no access to details about your web site or the user accounts it has. top displays details about running unix processes, including which unix user id (uid) each process is running as.

i.e. the 'nobody' mentioned by top is the Unix user which is running the apache process.

presumably your system is configured to run apache as user nobody as that is a minimal priviledge account which can't do much even if someone manages to compromise the apache program. this is quite normal. some systems run apache as user "apache", "httpd", "www-data", or some other username but running it as "nobody" is's just another unix user on the system.

unless you're using suexec or similar, all apache processes will be running as 'nobody', regardless of who happens to be logged in on your web site. since you're asking questions about who the nobody user is, i think it's safe to guess that you're not running suexec.

to summarise: it's NOT a problem and doesn't need to be worked around.

share|improve this answer

The web server handles incoming connections by forking off child httpd processes. Those "extra" processes will sit and wait for incoming connections so there's not a other words, there's spare processes waiting to handle incoming connection requests.

If you look through the config file for apache you'll see a setting that controls how many spare child processes are supposed to be waiting in the wings.

As these processes start handling new connections, if they're all busy even more httpd processes spawn off.

They're not all eating memory, though; it's misleading because some memory is being shared among other processes.

Watch your logfiles in /var/log (probably /var/log/http, /var/log/httpd, or /var/log/apache or /var/log/apache2). That lists all incoming requests.

You can monitor in realtime using tail -f /var/log//access.log ; use control-c to break out of it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.