Help - Search - Members - Calendar
Full Version: The number of httpd processes peak out suddenly. What makes this happen?
The Planet Forums > System Administration > Web Hosting
fooman
The server usually works very quiet but http processes sometimes peak out.
I checked the httpd process by the command "netstat -np |grep httpd"

When the server is normal, the reslut is like below.

# netstat -np |grep httpd

tcp 0 5988 ::ffff:74.5.*.121:80 ::ffff:112.*.48.*:3709 FIN_WAIT1 13599/httpd
tcp 0 12488 ::ffff:74.5.*.121:80 ::ffff:112.*.48.*:3707 FIN_WAIT1 17013/httpd
tcp 0 0 ::ffff:74.5.*.116:80 ::ffff:93.*.93.*:37910 ESTABLISHED 18392/httpd
tcp 0 0 ::ffff:74.5.*.117:80 ::ffff:118.*.9.*:52982 ESTABLISHED 18384/httpd
tcp 0 0 ::ffff:74.5.*.114:80 ::ffff:119.*.198.*:15954 ESTABLISHED 18393/httpd
unix 2 [ ] DGRAM 506011759 2021/httpd

=======================

but when httpd processes peak out suddenly, the result is like below.
You can see lots of UNIX Socket there.

It just suddenly happens, about twice a week. When it occurs,
I usually kill all the httpd processes by the command
"killall -9 httpd" and restart httpd, otherwise the server goes down.

anyone, please give me a hint why this happens.
or any way to kill only crazy numbers of UNIX Socket processes?


# netstat -np |grep httpd

tcp 0 0 ::ffff:74.5.*.121:80 ::ffff:124.*.*.27:55244 ESTABLISHED 13075/httpd
tcp 0 0 ::ffff:74.5.*.121:80 ::ffff:116.*.*.181:1859 ESTABLISHED 13134/httpd
tcp 0 0 ::ffff:74.5.*.121:80 ::ffff:210.*.*.58:1763 ESTABLISHED 13098/httpd
tcp 0 0 ::ffff:74.5.*.121:80 ::ffff:210.*.*.58:1764 ESTABLISHED 13059/httpd
unix 3 [ ] DGRAM 506002656 13111/httpd
unix 3 [ ] STREAM CONNECTED 506002642 12085/httpd
unix 3 [ ] STREAM CONNECTED 506002544 13056/httpd
unix 3 [ ] DGRAM 506002534 13121/httpd
unix 3 [ ] STREAM CONNECTED 506002101 13133/httpd
unix 3 [ ] DGRAM 505996981 12056/httpd
unix 3 [ ] DGRAM 505983903 13123/httpd
unix 3 [ ] STREAM CONNECTED 505983839 13079/httpd
unix 3 [ ] STREAM CONNECTED 505983830 13075/httpd
unix 3 [ ] STREAM CONNECTED 505983820 13080/httpd
unix 3 [ ] STREAM CONNECTED 505983816 13068/httpd
unix 3 [ ] STREAM CONNECTED 505983814 12145/httpd
unix 3 [ ] DGRAM 505983813 13073/httpd
unix 3 [ ] DGRAM 505983756 12153/httpd
unix 3 [ ] DGRAM 505983753 13117/httpd
unix 3 [ ] DGRAM 505983714 13102/httpd
unix 3 [ ] DGRAM 505983687 13060/httpd
unix 3 [ ] DGRAM 505983660 13116/httpd
unix 3 [ ] DGRAM 505983633 6103/httpd
unix 3 [ ] DGRAM 505983632 13089/httpd
unix 3 [ ] STREAM CONNECTED 505983487 13134/httpd
unix 3 [ ] STREAM CONNECTED 505983484 13059/httpd
unix 3 [ ] STREAM CONNECTED 505983480 13067/httpd
unix 3 [ ] STREAM CONNECTED 505983472 13098/httpd
unix 3 [ ] DGRAM 505983471 13131/httpd
unix 3 [ ] DGRAM 505983440 13052/httpd
unix 3 [ ] DGRAM 505983413 13054/httpd
unix 3 [ ] DGRAM 505983386 13118/httpd
unix 3 [ ] DGRAM 505983385 13065/httpd
unix 3 [ ] STREAM CONNECTED 505983321 12102/httpd
unix 4 [ ] STREAM CONNECTED 505983039 13126/httpd
unix 3 [ ] STREAM CONNECTED 505983035 12104/httpd
unix 3 [ ] STREAM CONNECTED 505983032 13064/httpd
unix 3 [ ] DGRAM 505982897 12139/httpd
unix 3 [ ] STREAM CONNECTED 505982733 11969/httpd
unix 3 [ ] DGRAM 505982700 12141/httpd
unix 3 [ ] DGRAM 505982596 7928/httpd
unix 3 [ ] DGRAM 505982184 9858/httpd
unix 3 [ ] DGRAM 505982097 6120/httpd
unix 3 [ ] STREAM CONNECTED 505982090 32405/httpd
unix 3 [ ] STREAM CONNECTED 505982061 12089/httpd
unix 3 [ ] DGRAM 505982049 8014/httpd
unix 4 [ ] STREAM CONNECTED 505981983 12967/httpd
unix 3 [ ] STREAM CONNECTED 505981793 9879/httpd
unix 3 [ ] STREAM CONNECTED 505981791 12023/httpd
unix 3 [ ] DGRAM 505981784 6824/httpd
unix 3 [ ] DGRAM 505981632 12095/httpd
unix 3 [ ] DGRAM 505981570 12054/httpd
unix 4 [ ] STREAM CONNECTED 505981504 12091/httpd
unix 3 [ ] STREAM CONNECTED 505981441 12081/httpd
unix 3 [ ] DGRAM 505981439 12025/httpd
unix 3 [ ] STREAM CONNECTED 505981327 11518/httpd
unix 3 [ ] STREAM CONNECTED 505981321 12079/httpd
unix 3 [ ] DGRAM 505981280 12031/httpd
unix 3 [ ] DGRAM 505981261 6065/httpd
unix 3 [ ] DGRAM 505981234 6118/httpd
unix 3 [ ] DGRAM 505981170 12097/httpd
unix 3 [ ] DGRAM 505981117 27217/httpd
unix 3 [ ] DGRAM 505981066 11924/httpd
unix 3 [ ] DGRAM 505980999 12030/httpd
unix 3 [ ] DGRAM 505980951 7930/httpd
unix 3 [ ] DGRAM 505980894 12087/httpd
unix 3 [ ] DGRAM 505980775 12118/httpd
unix 3 [ ] DGRAM 505980722 12109/httpd
unix 3 [ ] DGRAM 505980646 12147/httpd
unix 3 [ ] DGRAM 505980605 12138/httpd
unix 3 [ ] DGRAM 505980549 12150/httpd
unix 3 [ ] DGRAM 505980464 12044/httpd
unix 3 [ ] STREAM CONNECTED 505980440 11691/httpd
unix 3 [ ] STREAM CONNECTED 505980432 12006/httpd
unix 3 [ ] DGRAM 505980427 12161/httpd
unix 3 [ ] DGRAM 505980381 7905/httpd
unix 3 [ ] DGRAM 505980332 12132/httpd
unix 3 [ ] DGRAM 505979866 12111/httpd
unix 3 [ ] DGRAM 505979718 8623/httpd
unix 3 [ ] DGRAM 505979658 12004/httpd
unix 3 [ ] DGRAM 505979116 9081/httpd
unix 3 [ ] DGRAM 505967682 12100/httpd
unix 3 [ ] STREAM CONNECTED 505967664 12049/httpd
unix 3 [ ] DGRAM 505967617 12164/httpd
unix 3 [ ] DGRAM 505967547 12086/httpd
unix 4 [ ] STREAM CONNECTED 505967460 12005/httpd
unix 3 [ ] DGRAM 505967445 12142/httpd
unix 3 [ ] DGRAM 505967433 9878/httpd
unix 3 [ ] DGRAM 505967350 12131/httpd
unix 3 [ ] DGRAM 505967272 12045/httpd
unix 3 [ ] DGRAM 505967212 12099/httpd
unix 3 [ ] STREAM CONNECTED 505967070 12154/httpd
unix 3 [ ] DGRAM 505967069 12135/httpd
unix 3 [ ] DGRAM 505966996 12082/httpd
unix 3 [ ] DGRAM 505966965 12114/httpd
unix 3 [ ] DGRAM 505966870 11984/httpd
unix 3 [ ] DGRAM 505966822 7921/httpd
unix 3 [ ] DGRAM 505966797 7929/httpd
unix 3 [ ] DGRAM 505966783 12112/httpd
unix 3 [ ] DGRAM 505966717 7640/httpd
unix 3 [ ] DGRAM 505966677 12094/httpd
unix 3 [ ] DGRAM 505966588 6122/httpd
unix 3 [ ] DGRAM 505966519 11926/httpd
unix 3 [ ] DGRAM 505966516 12033/httpd
unix 3 [ ] DGRAM 505966489 5853/httpd
unix 3 [ ] DGRAM 505966488 12155/httpd
unix 3 [ ] STREAM CONNECTED 505966228 12042/httpd
unix 3 [ ] DGRAM 505966220 12026/httpd
unix 4 [ ] STREAM CONNECTED 505963225 12144/httpd
unix 4 [ ] STREAM CONNECTED 505962823 12007/httpd
unix 3 [ ] STREAM CONNECTED 505960925 11692/httpd
unix 2 [ ] DGRAM 495137547 5853/httpd

theuruguayan
Sounds like a spike of traffic or some bot like googlebot crawling a site in your server.

Probably good diea to check apache logs for that time.
fooman
there is no crawling log or attack log there at that time. It just happens suddenly.
Waht kind of situation will make UNIX Sockets?anyone?
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.