Is there an apache setting where I can kill processes that run longer than 90 seconds? I got a DDOS attack and almost ran out of memory because a bunch of apache process were running for a long time.
Take a look at the Apache module
mod_reqtimeout, the config setting used with it is
Example: Allow for 5 seconds to complete the TLS handshake, 10 seconds to receive the request headers and 30 seconds for receiving the request body:
RequestReadTimeout handshake=5 header=10 body=30
To enable the module run these commands:
sudo a2enmod reqtimeout # enable mod_reqtimeout sudo service apache2 restart # Re-start Apache
For more details consult Apache 2.4 mod_reqtimeout
On the response side, where a DDOS attack has induced lengthy PHP processing, look at
max_execution_time PHP setting, which is normally set in php.ini.
TimeOut setting is for network I/O timeouts. It restricts the time Apache waits for a TCP packet from a client, and the time Apache waits for acknowledgement when a TCP packet is sent to a client.