hello
please consider this posting as a request for enhancement
httpd knows about his overload situation.
---- [error] server reached MaxClients setting, consider raising the
MaxClients setting
this overload is easily created by an external attacker. in case of an
attack you have to react.
best done on a lower osi-layer (iptables, pf, ...).
realtime log analysis has his own odds and twists. we would prefer a call
to an 'external helper procedure'.
the following patch is a quick and dirty implementation.
--- httpd-2.2.4/server/mpm/worker/worker.c.orig 2007-04-12
12:58:28.000000000 +0200
+++ httpd-2.2.4/server/mpm/worker/worker.c 2007-04-12
15:44:04.000000000 +0200
@@ -135,6 +135,7 @@ static fd_queue_t *worker_queue;
static fd_queue_info_t *worker_queue_info;
static int mpm_state = AP_MPMQ_STARTING;
static int sick_child_detected;
+static int reported = 0;
/* The structure used to pass unique initialization info to each thread */
typedef struct {
@@ -1514,7 +1515,6 @@ static void perform_idle_server_maintena
/* terminate the free list */
if (free_length == 0) {
/* only report this condition once */
- static int reported = 0;
if (!reported) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0,
@@ -1522,6 +1522,10 @@ static void perform_idle_server_maintena
"server reached MaxClients setting, consider"
" raising the MaxClients setting");
reported = 1;
+ if(!fork()) {
+ system("/usr/local/bin/apache_overload");
+ exit(0);
+ }
}
idle_spawn_rate = 1;
}
@@ -1550,6 +1554,7 @@ static void perform_idle_server_maintena
}
else if (idle_spawn_rate < MAX_SPAWN_RATE) {
idle_spawn_rate *= 2;
+ reported = 0;
}
}
}
in this context we have some questions:
-- do you think it makes sense to implement this feature ?
-- could it be done in a module (without the overhead of going through the
scoreboard for each pre_connection call) ?
-- can we expect this enhancement in a future release ?
btw: we hope to see separately configurable timeouts (
http://httpd.apache.org/docs/2.2/mod/core.html#timeout ) very soon.
kind regards
juerg
-- input validation is for people who can't do forensics!
internet storm center at sans.org
