Hi,

A friend of mine told me about this forum. I hope
somebody can give me a clue on what's going on.

I'm quite new to CPanel/WebHostManager,
and now have a (serious?) problem.

Problem: Apache is always failed

I have done:

Checking httpd.conf file, but no syntax error
Changed StartServer, MinSpareServer, MaxSpareServer directives (in httpd.conf) to various numbers
Restarting apache, DNS
Restarting the server
[/list=1]

And tried many other things i could think of. But
the apache is still broken.

The server provider has fixed the problem a while ago.
But after about 6 hours, apache went down again.
Told the provider once again, and it fixed, only
for about 6 hours and then broken. And so on.

Unfortunately, the server provider never told me
how they fixed the problem. I asked them, but no
reply.

The server has about 160 namebased websites.
They are small sites as the average bandwidth/month is
about 15 Gigs in total. Server has 128 MB of RAM.
The average server load is 0.3-0.6. (Occasionally,
when CPanel updates the load is about 25).

ftp, mail services are normal.

[list=1]
Anyone have similar situation that may have an answer for this?
Do you think that the server needs more memory? (but the server load is low)
Is this a sign of somebody attacks the server (such as with DOS)? If so, how do I check it? Is this possible to check the apache error log file, given that the server has been configured to have individual error log for each websites?


Its been quite a while, and this problem
is starting to make my headache.

Anyone willing to help me? :confused:

If it is not already installed, have your ISP install the mod_status Apache module. This will allow you to get a real-time view of the number of sessions you have, etc. You should be able to use this information, in conjunction with information from running the TOP command to tracking down the cause of your failures:

http://httpd.apache.org/docs/mod/mod_status.html

You can see a sample of the output on my site if you would like:

http://www.allan.org/server-status

uuallan,

The mod is indeed installed.

So, I go to httpd.conf to allow me to
see the server-status form my ISP.

After seeing the page, there are so
many request from unknown host (stated
with ? sign) and vhost (stated with ? as well)
which currently in ...reading...
phase.

Does it mean that somebody has
tried to attack my server with DOS?

How to prevent this?

It looks like this is the problem, don't you
think so?

aya

It mioght be the problem, depends on the number of requests being processed and the number of idle servers.

If that is the case, find out if your ISP has a packet sniffer they can put on your network to monitor where the traffic is coming from (you also might be able to find it your Apache logs, or in /var/log/messages if it is a Linux box).

They should be able to block the traffic at the router/switch level. and keep it from getting to your server.