Have you ruled out a deliberate DOS attack? How quickly does it shoot to 255 processes? There is an option to increase the number of child threads the master can split off... but I suspect that increasing the limit would just provide more room for it to fill up. There might be some way to limit the number of connections per client. Still, the Apache worker thread controls might be helpful to read about here.
Are all of the connections from the same client IP? Or are you getting actions from lots of IPs where the child threads don't quit after finishing the transactions? There is a program called Apache Top, sort of like regular UNIX Top... but maybe it would help monitor this stuff? Or is that you are using? Are these threads initiating processes which interact with a database at all? Could the database connections not be closing cleanly, leaving Apache thinking it is still reading/writing/connected? What server side scripting are you using? PHP, Perl, Python, Ruby? What do the logs say? -Nick -----Original Message----- From: Vermont Area Group of Unix Enthusiasts [mailto:[EMAIL PROTECTED] On Behalf Of Phil Marshall Sent: Thursday, May 08, 2008 1:23 PM To: [email protected] Subject: Apache Problem Here is a sample from the apache status output. We are getting flooded with these. Apache will get filled up to 255 connections with these things. This has happened before, but usually it goes away quickly. Today it went on for about 45 minutes. Its fine now. Does anyone have any idea what this is or how to block it? 51-9 28349 0/1/1 R 0.00 28 3 0.0 0.02 0.02 ? ? ..reading.. 52-9 28350 0/1/1 R 0.00 28 0 0.0 0.000 0.000 ? ? ..reading.. 53-9 28351 0/2/2 R 0.00 28 0 0.0 0.000 0.000 ? ? ..reading.. 54-9 28352 0/1/1 R 0.00 28 0 0.0 0.000 0.000 ? ? ..reading.. 55-9 28354 0/1/1 R 0.00 28 78 0.0 0.00 0.00 ? ? ..reading.. 56-9 28355 0/1/1 R 0.00 28 0 0.0 0.000 0.000 ? ? ..reading.. --------------------- Phil Marshall Signal Advertising 535 Stone Cutters Way Montpelier, VT 05602 802-229-4149 [EMAIL PROTECTED]
