Apache Connection Problems

[dcool86]

I'm having problems with Apache at peak times on my server. When the server is at peak im using about 40% of my cpu. The problem is when I go to one or any of my domains during peak hours it keep thinking and will do nothing and return nothing after a few seconds. If I refresh the page while it's doing it the page loads fast like it should. It doesn't do it all the time. I'm using Apache virtual host for my domains. When I run "lynx [localhost...] at peak there is about 500 request currently being processed. I also run "netstat -plan | grep :80 | wc -l" at peak and around 25000+. I know it's a very busy server as I host stuff through JavaScript but the sizes are just bytes. I been messing with this for over 3 weeks I can't figure it out.


Server Info

OS: Ubuntu Linux 11.10
CPU: Intel(R) Xeon(R) CPU X5550 @ 2.67GHz, 8 cores
Ram: 12GB
Kernel and CPU: Linux 3.0.0-13-server on x86_64
Apache2 verison: 2.2.20 (Ubuntu)
Php Version: 5.3.6-13ubuntu3.2
Mysql Version: 5.1.58 (Has Been runing fine)

I have changed in apache2.conf

Timeout 30
KeepAlive Off
MaxKeepAliveRequests 0
KeepAliveTimeout 60

<IfModule mpm_prefork_module>
ServerLimit 2000
StartServers 500
MinSpareServers 100
MaxSpareServers 200
MaxClients 2000
MaxRequestsPerChild 0
</IfModule>

What my virtual domain looks like in /etc/apache2/sites-available

Example for all my domains.

<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
DocumentRoot "/home/example"
DirectoryIndex index.php
</VirtualHost>

I will provide any additional information if needed that's what I can think off of the top of my head you will need. I do not have any performance problems when the domain loads and it loads quick. I'm not sure what else to check or change. Thanks

[phranque]

have you tried using the apache benchmarking tool?

ab - Apache HTTP server benchmarking tool:
http://httpd.apache.org/docs/2.2/programs/ab.html [httpd.apache.org]

[dcool86]

I think I found the problem. In my syslog it keep saying

TCP: Possible SYN flooding on port 80. Sending cookies.
TCP: Possible SYN flooding on port 80. Sending cookies.
TCP: Possible SYN flooding on port 80. Sending cookies.

Feels the whole log up

I tried changing net.ipv4.tcp_syncookies =1 to 0 but it then said

TCP: Possible SYN flooding on port 80. Dropping request.

so I changed it back to 1

My server is a busy server that can handle the load just something is limiting it. I'm not sure what to change to fix that error.

[jalarie]

I'm just beginning to learn Apache, so I have nothing specific to say. I saw something similar to this on the grc.com site when they were attacked. You might learn something useful there.

[lucy24]

TCP: Possible SYN flooding on port 80.

sounds sinister but may not mean anything useful at all if I'm correctly interpreting

no warning in any logs at all, except with the usual

web10 kernel: possible SYN flooding on port 80

from Apache mailing list.

I tried this exact search

"Possible SYN flooding" "port 80" site:.apache.org

That gets you the archived mailing lists. Have fun disentangling the threads; I couldn't figure out how to do it except by brute force. Helps that the question I was trying to follow was posted on 30 September, so all the answers came in on 1 October, putting them in a whole new segment of the archives.

[dcool86]

@jalarie As I said earlier it's a busy server with real traffic not a attack. Thanks for the reply.