I have a production server that in the last 24 hours has been hard rebooted 4 times due to freezes. Ping is fine but all other services time-out (Apache, SSHd, etc). I have now diagnosed it to Apache running out of memory due to an exorbitant amount of child processes forking suddenly within seconds of starting Apache. Stopping Apache just after rebooting keeps the server stable again.
My two questions are:
Is there a way to detect which of the vhosts is being suddenly hammered without looking into each vhost's access log one by one?
Is there a way to quickly enable/disable vhosts without commenting (#) them all out in httpd.conf?
A few system details:
Fedora 10, x86_64, PHP 5, Apache 2.2
Try setting up a status page using mod_status. If you can get in after starting up your server you should see a page like this which shows each connection with its corresponding vhost, and URL.
If your site is so heavily flooded that you can't get in, try running
netstat -nt | grep :80
orlsof -ni tcp:80
to see if one or two addresses are flooding your site and apply iptables accordingly.1) I often use lsof to see what files/directories apache has open during time of high load. So for instance (on debian/ubuntu) you could run:
and then to get something more useful, only search for open files in the correct location (e.g. /home) and then exclude the log files which should always be open.
You may have to run this a few times to get an idea of what is running often.
2) If your running debian/ubuntu you can use the a2ensite and a2dissite to automatically add and remove vhosts from your apache setup.