Forum Moderators: phranque

Message Too Old, No Replies

Apache hangs up

Possible attack?

         

sharebay

6:26 am on Jun 27, 2007 (gmt 0)

10+ Year Member



httpd hangs up and i dont know why, it just happened yesterday and never before, i havent changed anything on the server configuration, i restarted httpd and its solved for now but i need to know what may caused it so it cant happen again.

Thats in httpd error log:

Quote:

[Mon Jun 25 10:32:56 2007] [notice] child pid 9867 exit signal Segmentation fault (11)
[Mon Jun 25 10:37:08 2007] [notice] child pid 9908 exit signal Segmentation fault (11)
[Mon Jun 25 10:37:08 2007] [notice] child pid 10466 exit signal Segmentation fault (11)
[Mon Jun 25 10:37:08 2007] [notice] child pid 10495 exit signal Segmentation fault (11)
[Mon Jun 25 12:38:10 2007] [error] [client 84.***.60.233] File does not exist: /var/www/html/aff/katz1_176x31.gif
[Mon Jun 25 15:22:18 2007] [error] [client 72.**.177.85] File does not exist: /var/www/html/robots.txt
[Mon Jun 25 15:22:19 2007] [error] [client 74.*.72.119] File does not exist: /var/www/html/robots.txt
...
...
[Mon Jun 25 17:55:33 2007] [warn] child process 25550 still did not exit, sending a SIGTERM
[Mon Jun 25 17:55:39 2007] [warn] child process 21897 still did not exit, sending a SIGTERM
[Mon Jun 25 17:55:39 2007] [warn] child process 23537 still did not exit, sending a SIGTERM
[Mon Jun 25 17:55:39 2007] [warn] child process 20129 still did not exit, sending a SIGTERM
[Mon Jun 25 17:55:39 2007] [warn] child process 24870 still did not exit, sending a SIGTERM
[Mon Jun 25 17:55:39 2007] [warn] child process 28436 still did not exit, sending a SIGTERM
[Mon Jun 25 17:55:39 2007] [warn] child process 18491 still did not exit, sending a SIGTERM
...
...
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9832 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9838 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9843 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9846 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9847 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9850 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9854 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9858 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9863 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9866 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9868 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9869 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [error] could not make child process 9892 exit, attempting to continue anyway
[Mon Jun 25 17:55:45 2007] [notice] caught SIGTERM, shutting down
[Mon Jun 25 17:55:49 2007] [notice] mod_security/1.9.4 configured
[Mon Jun 25 17:55:50 2007] [notice] Apache/1.3.37 (Unix) mod_ssl/2.8.28 OpenSSL/0.9.7a PHP/4.4.4 mod_perl/1.29 FrontPage/5.0.2.2510 configured -- resuming normal operations
[Mon Jun 25 17:55:50 2007] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Mon Jun 25 17:55:50 2007] [notice] Accept mutex: sysvsem (Default: sysvsem)

Could not exit child process?

Today apache didn't die, but i got this error in the logs:

Quote:

[Tue Jun 26 11:39:27 2007] [notice] child pid 13218 exit signal Segmentation fault (11)
[Tue Jun 26 11:44:58 2007] [notice] child pid 15145 exit signal Segmentation fault (11)
*** glibc detected *** free(): invalid next size (fast): 0x09f7fcd8 ***
[Tue Jun 26 11:45:26 2007] [notice] child pid 14268 exit signal Aborted (6)
[Tue Jun 26 11:49:12 2007] [error] server reached MaxClients setting, consider raising the MaxClients setting]

Can it be that someone tries to attack the dedi causing max clients to exceed and httpd to go down?
i have mod_evasive installed but

Quote:

[Tue Jun 26 05:31:38 2007] [error] [client 88.**.169.29] File does not exist: /var/www/html/images/REG.gif
[Tue Jun 26 06:55:57 2007] [error] [client 74.*.75.21] File does not exist: /var/www/html/robots.txt
[Tue Jun 26 07:51:11 2007] [error] [client 66.***.66.145] File does not exist: /var/www/html/robots.txt
[Tue Jun 26 08:12:21 2007] [error] [client 64.***.154.1] File does not exist: /var/www/html/uploads/88x312ccce79epng.png
[Tue Jun 26 08:14:19 2007] [error] [client 84.***.50.42] File does not exist: /var/www/html/ruttibutton.gif
[Tue Jun 26 08:18:40 2007] [error] [client 85.**.241.81] File does not exist: /var/www/html/folder_js_skin/ips_menu_html.js
[Tue Jun 26 08:20:19 2007] [error] [client 84.***.50.42] File does not exist: /var/www/html/ruttibutton.gif
[Tue Jun 26 08:43:47 2007] [error] [client 212.**.172.2] File does not exist: /var/www/html/style_images/zachskin-1/nav.gif
[Tue Jun 26 08:43:47 2007] [error] [client 212.**.172.2] request failed: error reading the headers
[Tue Jun 26 08:43:47 2007] [error] [client 212.**.172.2] Client sent malformed Host header
[Tue Jun 26 08:43:50 2007] [error] [client 212.**.172.2] File does not exist: /var/www/html/style_images/zachskin-1/t_new.gif
[Tue Jun 26 08:43:51 2007] [error] [client 212.**.172.2] File does not exist: /var/www/html/style_images/zachskin-1/t_new.gif
[Tue Jun 26 08:43:52 2007] [error] [client 212.**.172.2] File does not exist: /var/www/html/style_images/zachskin-1/nav_m.gif
[Tue Jun 26 08:43:53 2007] [error] [client 212.**.172.2] request failed: erroneous characters after protocol string: GET /style_images/zachskin-1/menu_action_down.gif HTGET /style_images/zachskin-1/menu_action_down.gif HTTP/1.1
[Tue Jun 26 08:43:56 2007] [error] [client 212.**.172.2] request failed: error reading the headers
[Tue Jun 26 08:43:56 2007] [error] [client 212.**.172.2] request failed: erroneous characters after protocol string: GET /style_images/zachskin-1/p_pm.gif HTGET /style_images/zachskin-1/p_pm.gif HTTP/1.1
[Tue Jun 26 08:43:56 2007] [error] [client 212.**.172.2] File does not exist: /var/www/html/style_images/zachskin-1/p_up.gif
[Tue Jun 26 08:43:57 2007] [error] [client 212.**.172.2] Client sent malformed Host header
[Tue Jun 26 09:50:07 2007] [error] [client 213.*.171.90] File does not exist: /var/www/html/wl.gif
[Tue Jun 26 09:53:33 2007] [error] [client 74.*.75.21] File does not exist: /var/www/html/robots.txt
[Tue Jun 26 09:59:47 2007] [error] [client 213.*.171.90] File does not exist: /var/www/html/wl.gif
[Tue Jun 26 11:03:02 2007] [error] [client 83.**.248.69] File does not exist: /var/www/html/img155/4306/13495150f286mq2.png
[Tue Jun 26 11:03:02 2007] [error] [client 83.**.248.69] File does not exist: /var/www/html/albums/a400/clemclone/tsbay/Donate.gif
[Tue Jun 26 11:16:35 2007] [error] [client 84.***.18.174] File does not exist: /var/www/html/uploads/88x311a475a09gif.gif
[Tue Jun 26 11:39:27 2007] [notice] child pid 13218 exit signal Segmentation fault (11)
[Tue Jun 26 11:44:58 2007] [notice] child pid 15145 exit signal Segmentation fault (11)
*** glibc detected *** free(): invalid next size (fast): 0x09f7fcd8 ***
[Tue Jun 26 11:45:26 2007] [notice] child pid 14268 exit signal Aborted (6)
[Tue Jun 26 11:49:12 2007] [error] server reached MaxClients setting, consider raising the MaxClients setting
[Tue Jun 26 14:01:02 2007] [error] [client 166.***.138.241] File does not exist: /var/www/html/img112/8689/ddl2rn9.gif
[Tue Jun 26 14:01:32 2007] [error] [client 166.***.138.241] File does not exist: /var/www/html/files/39408832/picex_horg.rar
[Tue Jun 26 14:01:32 2007] [error] [client 166.***.138.241] File does not exist: /var/www/html/files/39408832/picex_horg.rar
[Tue Jun 26 14:11:18 2007] [error] [client 82.***.163.10] File does not exist: /var/www/html/_misc/revsci/DM_Client.js
[Tue Jun 26 14:28:39 2007] [error] [client 213.**.25.7] request failed: error reading the headers
[Tue Jun 26 14:43:52 2007] [error] [client 66.***.66.145] File does not exist: /var/www/html/robots.txt
[Tue Jun 26 15:41:15 2007] [error] [client 64.***.172.172] File does not exist: /var/www/html/robots.txt
[Tue Jun 26 16:05:30 2007] [error] [client 82.***.190.237] File does not exist: /var/www/html/image/button.gif
[Tue Jun 26 16:14:39 2007] [error] [client 208.**.144.7] Client sent malformed Host header
[Tue Jun 26 16:43:37 2007] [error] [client 208.**.144.7] Client sent malformed Host header
[Tue Jun 26 17:19:26 2007] [error] [client 64.***.172.172] File does not exist: /var/www/html/robots.txt
[Tue Jun 26 17:27:58 2007] [error] [client 208.**.144.7] Client sent malformed Host header
[Tue Jun 26 17:29:17 2007] [error] [client 66.***.70.156] File does not exist: /var/www/html/robots.txt
[Tue Jun 26 18:01:57 2007] [error] [client 208.**.144.7] Client sent malformed Host header
[Tue Jun 26 18:07:57 2007] [error] [client 208.**.144.7] Client sent malformed Host header
[Tue Jun 26 18:28:49 2007] [error] [client 125.***.201.244] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /style_images/zachskin-1/pages_icon.gif
[Tue Jun 26 18:44:42 2007] [error] [client 124.***.100.28] File does not exist: /var/www/html/in.php
[Tue Jun 26 19:41:00 2007] [error] [client 74.*.19.123] File does not exist: /var/www/html/robots.txt
[Tue Jun 26 19:49:19 2007] [error] [client 208.**.144.7] Client sent malformed Host header
[Tue Jun 26 19:54:54 2007] [error] [client 74.*.75.39] File does not exist: /var/www/html/robots.txt
[Tue Jun 26 20:23:34 2007] [error] [client 203.***.205.166] request failed: error reading the headers

'Client sent malformed Host header'

[edited by: jdMorgan at 9:27 pm (utc) on June 27, 2007]
[edit reason] Obscured IP addresses. Please see forum charrter. [/edit]