I run apache 2.2.9 with mpm prefork on debian lenny. Following http://httpd.apache.org/docs/2.2/mod/prefork.html, I would expect that there is one parent process, running as root and listening as configured, which would start child processes as defined by the Min/Max/etc. directives. I expect the children to be restarted as per MaxRequestsPerChild, but the parent process to stay put with one process id until I restart it manually.

Out of a little paranoia, I started monitoring listening ports including process ids. I have a cron job every 20 minutes to run netstat -ap | grep LISTEN and diff the output. Sometimes (about once per day) I see a series of this:

< tcp6       0      0 [::]:www                [::]:*                  LISTEN      6194/apache2    
tcp6       0      0 [::]:www                [::]:*                  LISTEN      6607/apache2    
< tcp6       0      0 [::]:https              [::]:*                  LISTEN      6194/apache2    
tcp6       0      0 [::]:https              [::]:*                  LISTEN      6607/apache2

Over a period of an hour or three, the parent would change its pid at least once every 20 minutes, without any explanation in the log files or any other hint that anything is going wrong.

This is not what I expected. What am I missing?


Is that from logrotate?

cat /etc/logrotate.d/apache2

Take a look at /var/log/syslog

In addition, a less verbose event log is in /var/log/daemon.log

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.