Hi all

I am encounting a problem here. One of server keep crashing.
I noticed that there is always a bad http connection that is eating up the ram badly. But I haven't had chance to check server-status before it crash. Is there a way we can limit the amount memory each httpd can take??

Note: please take a look at PID 17015. It took 79% of ram resources.

4:31pm up 1:17, 1 user, load average: 36.48, 17.99, 8.19
227 processes: 222 sleeping, 4 running, 1 zombie, 0 stopped
CPU states: 19.1% user, 13.3% system, 0.0% nice, 67.5% idle
Mem: 771080K av, 767560K used, 3520K free, 40K shrd, 3132K buff
Swap: 2048248K av, 2048248K used, 0K free 11528K cached

PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME COMMAND
5 root 9 0 0 0 0 DW 3.9 0.0 0:06 kswapd
17015 httpd 9 0 2535M 594M 284 D 3.8 79.0 0:17 httpd
5602 root 10 0 676 624 340 R 0.5 0.0 0:40 top
17062 httpd 9 0 4020 2096 1544 S 0.4 0.2 0:01 httpd
16981 root 9 0 224 204 96 S 0.3 0.0 0:04 rotatelogspsoft
17077 httpd 9 0 3796 2076 1608 S 0.3 0.2 0:01 httpd

One other question.. I noticed that PID 17015 has an RSS value of 594M. Does anyone know what RSS value is ?

Give your IP permission to view the server-status page. Next time that happens, reload the server-status page for Apache and match the PID in top/ps to the PID on that page, and you'll see the path to the web site and file of the user/site that is causing that load. Likely it's a badly written PHP script (possibly CGI as well). Finally, set memory, process and cpu limits in your web server, to prevent bad scripts/processes from taking down the entire web server or system (and not worry as much about it all crashing -- even though you'll still have problems until you track down and deal with the offending file causing this load).

Hi Tim..

Thanks for the advice. I did indeed try to match the httpd with server-status. Its just that badly written PHP seems to excute at random time. It crash the server before we can check it. That was the SSH screen when server crashed. Anyway. I guess we have to spend time watching it.

Originally posted by Eiv
One other question.. I noticed that PID 17015 has an RSS value of 594M. Does anyone know what RSS value is ?

RSS means Resident Set Size, or the amount of RAM actually used by the process. In my experience, you can't trust the output from ps to be 100 percent accurate, but that's what it's supposed to mean.