-2

enter image description here

I have no idea why it's crashing. But here is some of my error log:

[Thu Dec 29 03:23:45 2011] [error] [client 94.142.134.238] File does not exist: /var/www/phpMyAdmin
[Thu Dec 29 03:24:38 2011] [error] [client 96.240.84.138] File does not exist: /var/www/crossdomain.xml, referer: http://s.nsdsvc.com/App/DddWrapper.swf?c=4
[Thu Dec 29 03:36:19 2011] [error] [client 68.0.155.173] File does not exist: /var/www/crossdomain.xml, referer: http://s.nsdsvc.com/App/DddWrapper.swf?c=4
[Thu Dec 29 03:48:00 2011] [error] server reached MaxClients setting, consider raising the MaxClients setting
zend_mm_heap corrupted

More

[Wed Dec 28 19:17:32 2011] [error] [client 180.253.219.197] File does not exist: /var/www/sitemap.xml
[Wed Dec 28 19:19:36 2011] [error] [client 66.31.52.24] File does not exist: /var/www/crossdomain.xml
[Wed Dec 28 19:20:38 2011] [error] [client 67.197.205.1] Invalid URI in request 8th-2011-a.html HTTP/1.1
[Wed Dec 28 19:23:08 2011] [error] [client 67.197.205.1] Invalid URI in request 7e12e6845d73e4e HTTP/1.1

This is from my error.log. My access log is 800MB, do you guys delete your access.log after a while?

Any idea what causes the crash? Thanks!

EDIT: Surprising it hasn't crashed for 30 minutes now.

Improve this question
6
  • 800mb log!?!?! logrotate often?
    – Lamar B
    Dec 29, 2011 at 4:27
  • @Lamar B # rotate log files weekly weekly # keep 4 weeks worth of backlogs rotate 4 Should it put it daily?
    – Muazam
    Dec 29, 2011 at 4:43
  • On hight load web servers its good to disable access logs. (Enabling only for testing and diagnoze).
    – B14D3
    Dec 29, 2011 at 6:59
  • 1
    @B14D3: I don't agree! If you disable the access logs, you will not be able to monitor your server usage and see possible errors/hack attempts, etc..
    – Khaled
    Dec 29, 2011 at 10:57
  • @Khaled on web server with large number connections enabling access logs can result IO problems. For error you always have error logs. About server usage you have right but thats why I wrote "Enabling only for testing and diagnoze" You can monitor all other server parameters and when you are alarmed that something is going wrong you can always enable access log. I'm talking about hight load web servers if you have server with small amount of connections then disabling access logs gives you nothing
    – B14D3
    Dec 29, 2011 at 11:48

2 Answers 2

Reset to default
0

I've seen those types of entries in my access logs. It's someone trying to sniff for known exploits, for example the /var/www/phpMyAdmin entry means someone is trying to test to see if you have phpMyAdmin installed under it's default path. If you did they would probably proceed to try to crack the admin password.

It seems like your site is under attack (Denial of Service) in that someone is trying to flood your server so you receive errors like 'MaxClients' being reached.

Here is a pretty good article about setting up some filters to protect you from these types of requests.

Improve this answer
0

Your screen shot and your error logs are telling two totally different stories.
As per your screenshot you are trying to run apache on 0.0.0.0 on port 80 which is already binded. Check who is listening there. Run the following:

netstat -tanlp | grep 80

After this your logs are stating that server reached MaxClients setting, consider raising the MaxClients setting that means that you have too many connections. Either your website is really popular or someone is trying to bombard your apache with requests to crash it intentionally. You can increase the connections from httpd.conf. Increase MaxClients there to a higher value.

Regarding zend_mm_heap corruptedcheck out this bug report. Some one on stackoverflow fixed it by increasing output_buffering= value in php.ini.

Please use logrotate to reduce the size of your logs. It'll split your logs on the basis of parameters you specify in conf/ Check out other logrotate conffiles in /etc/logrotate.d/

Improve this answer
1
  • Since you have not crashed since last 30 minutes, Zend bug might not be the issue. Increase MaxClients for sure.
    – Aditya Patawari
    Dec 29, 2011 at 6:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .