This one time, at band camp, Voytek Eymont wrote: >I noticed my web server was kind off slow, and, saw this, is this some >sort of dos attack ? > >how to control ? > ># service httpd status >httpd (pid 10774 10773 10772 10771 10769 10768 10766 10754 10749 10746 >10742 10741 10740 10739 10738 10737 10736 10735 10733 10732 10731 10730 >10728 10727 10723 10720 10719 10717 10712 10711 10710 10709 10707 10706 >10704 10673 10672 10671 10670 10666 10665 10663 10660 10659 10658 10657 >10655 10654 10652 10649 10648 10644 10613 10612 10611 10610 10608 10607 >10606 10600 10599 10598 10597 10596 10595 10592 10301 10297 10237 10236 >10235 10234 10233 10232 10230 10227 10223 10222 10219 10218 10216 10210 >10209 10208 10207 10204 10203 10196 10194 10172 10169 10163 10137 10132 >10127 10122 10100 10088 10061 10059 10058 10056 10055 10025 10024 9994 >9993 9973 9972 9970 9969 9968 9923 9910 9909 9908 9905 9895 9851 9846 9836 >9831 9812 9811 9809 8490 8483 8470 4729 4725 4719 4718 4715 4713 26699 >24831 12262 12261 12259 11059 11058 11057 11056 11050 11049 11048 11045 >10568 27458 27457 1627) is running... ># service httpd reload >Reloading httpd: [ OK ] ># service httpd status >httpd (pid 12049 12042 12036 12035 12034 12033 12032 12031 12030 12029 >1627) is running... ># service httpd status >httpd (pid 12272 12271 12270 12269 12268 12267 12266 12265 12264 12263 >12261 12260 12258 12256 12255 12247 12202 12201 12200 12199 12198 12197 >12196 12195 12194 12193 12192 12191 12190 12189 12188 12187 12186 12185 >12184 12183 12182 12181 12177 12176 12175 12174 12173 12169 12167 12166 >12165 12163 12159 12158 12157 12155 12154 12153 12152 12151 12150 12149 >12148 12147 12146 12145 12144 12143 12142 12141 12140 12139 12138 12137 >12136 12135 12134 12133 12132 12131 12130 12129 12128 12126 12125 12124 >12123 12122 12121 12120 12119 12118 12117 12116 12115 12114 12113 12112 >12111 12110 12109 12108 12107 12106 12105 12104 12103 12102 12101 12100 >12099 12098 12097 12096 12095 12093 12092 12091 12090 12089 12088 12087 >12086 12085 12084 12083 12082 12081 12080 12079 12078 12076 12075 12074 >12073 12072 12071 12070 12069 12067 12066 12065 12064 12063 12062 12042 >12036 12035 12034 12033 12032 12031 12030 12029 1627) is running... ># service httpd reload >Reloading httpd: [ OK ] ># service httpd status >httpd (pid 12435 12434 12433 12432 12427 12426 12424 12419 12418 12417 >12416 12415 12414 12413 12412 1627) is running... ># service httpd status >httpd (pid 12462 12461 12459 12458 12457 12456 12455 12454 12435 12434 >12433 12432 12427 12426 12424 12419 12418 12417 12416 12415 12414 12413 >12412 1627) is running...
A bunch of children isn't indicative of a DoS. What's your MaxChild (or whatever the real option is called) settings look like? Apache spawns off a lot of subprocesses to cope with load -- if you're worried that they're taking up resources, do some measurement on your capacity and tune the numbers. You want to look into the status module, and peek at the status of all of the workers. Also do some log analysis and see how fast the hits are coming, and how much work your apache subprocesses are doing. Again, get a measure of your server's capacity before you decide if you're being DoS'd. -- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
