Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an Medium EC2 instance running Ubuntu 12.04, serving about a dozen small PHP web applications via Apache.

Approximately every other day, the server becomes unresponsive and rebooting the instance is required to restore functionality. During this time, the server cannot be accessed via HTTP or SSH.

Every time, the last logged Apache request is to a PHP application that serves a 4MB PDF document. The User Agent always identifies the client as an iPad (specifically Mozilla/5.0 (iPad; CPU OS 6_1_3 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10B329 Safari/8536.25) and is often the same IP address, and therefore likely the same user.

The PHP application is a legacy application, and checks some permissions before echo-ing the contents of a file from disk to the client. We have not been able to reproduce this issue ourselves, either using an iPad, nor by accessing the file by any other means.

We've tried a few monitoring solutions to try and get a better picture of what's happening when the server goes down, but none of them appear show any issue with system resources.

My question is what are some strategies we can use to try and troubleshoot and hopefully resolve this issue?

share|improve this question
You have noone with an ipad around to try to download that pdf? Also see… – ott-- Sep 11 '13 at 12:50
are you monitoring resource utilisation on your server using any monitoring tool or any script? Issue possibly due to not enough memory to serve application. Check resource utilisation closely. – Pratap Sep 11 '13 at 12:51
You really should be using readfile() or http_send_file() to transmit the file. Using echo sounds like a recipe for disaster. – Michael Hampton Sep 11 '13 at 13:23
@ott-- as mentioned above, we have tried this with an iPad and been unable to reproduce. Thanks for the SO link, although not the cause of the issue here. – Mathew Byrne Sep 11 '13 at 13:31
@PratapSingh have used AWS monitoring and New Relic, neither of which have reported issues around any incidents. Looking at a lower level solution like collected atm. – Mathew Byrne Sep 11 '13 at 13:32

Start by monitor system resources (cpu load, memory, disk), for example with collectd or sysstat.

Keep in mind that I'm going out on a limb here, the problem you are describing might result from an exhaustion of a resource (most likely memory), run egrep -i 'killed process' /var/log/* to look for OOM killer invocations.

System logs might contain traces of the cause (/var/log/messages, apache's error logs).

Try enabling more detailed logs and pay close attention to your system while testing it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.