Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On my dev server. Evey so often apache2 just falls over. Its no longer running as a process.

Server details: Linux Debian etch Apache2

# ps aux | grep apache
www-data  6782 99.9  0.2   4792  2912 ?        R    Oct12 8592:53 /usr/sbin/apache/log
root     22418  0.0  0.0   2852   704 pts/2    S+   13:31   0:00 grep apache

# apache2ctl restart
httpd not running, trying to start
(98)Address already in use: make_sock: could not bind to address [::]:80
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs

When I check the /var/log/apach2/error.log There is nothing in there.

I guess I want to do two things.

  1. Figure out why apache is falling over. Fix it

  2. Congifure where nessacary so it doesn't happen again and maybe set up log files better?

If i restart the machine I can get apache up and running again. can anyone explain what is going on here?

Thanks, Derek

share|improve this question
add comment

4 Answers 4

up vote 1 down vote accepted

I'm afraid you may have been hacked. I would run a tool that checks for a root kit and look for any rogue php scripts. Check out /tmp for any weird files or scripts. I think debian has rkhunter in the apt repos. Good luck.

share|improve this answer
    
really!? thats not good. right well a quick look in /tmp and there is one folder there i don't know understand why it is there or what it is for. /tmp/hsperfdata_root there seems to be two files in there. not sure what they are.. maybe java files but they are just name by numbers with no file extensions. I don't use java on this server. –  Derek Organ Oct 18 '09 at 17:13
1  
hsperfdata should be nothing to worry about. I found this link while trying to figure out what /usr/sbin/apache/log could be. interworx.com/forums/showthread.php?p=16421 –  egorgry Oct 18 '09 at 17:30
    
crap! found some sneaky ".txt" files that are actually scripts in /var/tmp. I'll update here on what I find. thanks for the link. –  Derek Organ Oct 18 '09 at 17:41
    
I think I found the problem and the fix using APT-GET .. lists.debian.org/debian-security-announce/2008/msg00056.html –  Derek Organ Oct 18 '09 at 19:20
add comment

First thing I would do is go look for a /usr/sbin/apache/log file, and see what the hell that is. It looks very strange. Even if it looks like a valid binary, try "strings /usr/sbin/apache/log | less", to look for anything suspicious.

ps should be displaying the executed command there, afaik, and no command like /usr/sbin/*/log should exist. On my system (ubuntu), ps lists /usr/sbin/apache2 there. I use debian regularly too, and as far as I recall, the setup is identical on Debian. Also, check the output of "pgrep -l apache".

IF you find out that something normal is going on (i.e., your server hasn't been hacked) then you might try making sure that you're not running a multithreaded mpm that's incompatible with some module (especially php). Also, check things like disk space, permissions, etc. Apache does like to give up and crash if its log files are inaccessible, but usually that happens on startup. Something similar might be happening with files that aren't opened until later (although I can't think what those files would be --- htaccess and password files should fail gracefully).

share|improve this answer
add comment

It appears that pid 6782 is an apache process, so why do you think it's not running? That process is probably holding port 80 open, which is why you can't start a new one.

I'm willing to bet that what's killing it is the "restart" that happens when it rotates log files. But you won't know until it happens again and you can get both a real "ps" output and maybe an "strace" or "truss" on the stuck process.

share|improve this answer
    
sorry.. there seems to be a bit missing there on the text.. /usr/sbin/apace/log is the process.. Not sure how that is the case. –  Derek Organ Oct 18 '09 at 14:01
    
That's very unlikely. There is no such file as /usr/sbin/apache/log on Debian. Try doing a "ps auwwx" and paste the real results. –  Paul Tomblin Oct 18 '09 at 14:07
    
crap.. I can't do that now as I had to get apache running again so I rebooted to get apache up and running again. I agree there is no file /usr/sbin/apache/log... that's what confused me. but that is what it said. –  Derek Organ Oct 18 '09 at 15:50
2  
It may be a rootkit. –  Xorlev Oct 18 '09 at 17:06
add comment

The only time I saw something like this was when the network interface was not configured and apache kinda started but just hung itself. If your system is configured to assign IP by DHCP, this could be a weakness. Of course if you are ssh'ed into same interface apache listens on, then this isn't the issue!

Perhaps find out what is listening on port 80 this way:

lsof -Pni | grep ":80 "
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.