Hi,
I had been doing some pptp roadwarrior testing which involved using Live Log. Now, for some reason, it had started not to update itself - so I was using from within the browser to refresh the view.
All went well til I was later timed out of the system and logged off. When I tried to log on again - nothing! blank screen and no connection.
I logged on via the console, examined a few logs and found this in the /var/log/httpd.error_log:
[Wed Feb 19 14:18:25 2003] [error] server reached MaxClients setting, consider raising the MaxClients setting
I checked the value in httpd.conf and it was set to 50. Strange I thought, raised it to 75 and restarted httpd via the /etc/rc.d/httpd SYSV script.
Now it was OK to log back in to Webadmin but I started getting emails like:
[asl..com] [WAR 103] Allocating to much swap - please check(1 times)
So I checked the hardware reporting and SWAP had jumped to 97 MB from an average 35MB. Logged onto the console and did a "ps ax" and found this amongst it all.....
4936 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1524772496036 pptp
4954 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1524772496036 pptp
5339 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1524772496036 packetfilter
6156 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1524772496036 pptp
7110 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1524772496036 pptp
7163 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1524772496036 pptp
10096 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1820578817118 pptp
13802 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1820578817118 pptp
15572 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1820578817118 pptp
18946 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1820578817118 pptp
19191 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1820578817118 pptp
19328 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1820578817118 pptp
21059 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1820578817118 pptp
21117 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1820578817118 pptp
21175 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1820578817118 pptp
21219 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1820578817118 pptp
26213 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1961247368323 pptp
26321 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1961247368323 pptp
26389 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1961247368323 pptp
26402 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1961247368323 pptp
26441 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1961247368323 pptp
8487 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1412122550726 pptp
8513 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1412122550726 pptp
8662 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1412122550726 pptp
8725 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1412122550726 pptp
8752 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1412122550726 pptp
13314 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
13831 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
13841 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
13853 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
13873 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
13897 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
13910 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
13924 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
13938 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
13952 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
13965 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
13979 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
13993 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
14022 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
14036 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
14049 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
14071 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
14082 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
14094 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
14125 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
14154 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
14635 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
14654 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
14662 ? S 0:00 /usr/local/httpd/htdocs/_log.pl live 1718179770120 pptp
Killed them all and all is now back to normal. It looks like refreshing the live log spawned all these processes which effectively DoSed the system....
I'm currently stil evaluating on a old version of 3.2 (the web download) but does anyone know if this is known of?
Anyone fancy trying to reproduce it?
Thanks
This thread was automatically locked due to age.