Home / server / Questions / 75644
Accepted
Derek Organ
Asked: 2009-10-19 04:37:37 +0800 CST

Apache2 falling over

  • 772

On my dev server. Evey so often apache2 just falls over. Its no longer running as a process.

Server details: Linux Debian etch Apache2

# ps aux | grep apache
www-data  6782 99.9  0.2   4792  2912 ?        R    Oct12 8592:53 /usr/sbin/apache/log
root     22418  0.0  0.0   2852   704 pts/2    S+   13:31   0:00 grep apache

# apache2ctl restart
httpd not running, trying to start
(98)Address already in use: make_sock: could not bind to address [::]:80
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs

When I check the /var/log/apach2/error.log There is nothing in there.

I guess I want to do two things.

  1. Figure out why apache is falling over. Fix it

  2. Congifure where nessacary so it doesn't happen again and maybe set up log files better?

If i restart the machine I can get apache up and running again. can anyone explain what is going on here?

Thanks, Derek

linux

4 Answers

  1. Best Answer

    I'm afraid you may have been hacked. I would run a tool that checks for a root kit and look for any rogue php scripts. Check out /tmp for any weird files or scripts. I think debian has rkhunter in the apt repos. Good luck.

    • 1

  2. It appears that pid 6782 is an apache process, so why do you think it's not running? That process is probably holding port 80 open, which is why you can't start a new one.

    I'm willing to bet that what's killing it is the "restart" that happens when it rotates log files. But you won't know until it happens again and you can get both a real "ps" output and maybe an "strace" or "truss" on the stuck process.

    • 0

  3. First thing I would do is go look for a /usr/sbin/apache/log file, and see what the hell that is. It looks very strange. Even if it looks like a valid binary, try "strings /usr/sbin/apache/log | less", to look for anything suspicious.

    ps should be displaying the executed command there, afaik, and no command like /usr/sbin/*/log should exist. On my system (ubuntu), ps lists /usr/sbin/apache2 there. I use debian regularly too, and as far as I recall, the setup is identical on Debian. Also, check the output of "pgrep -l apache".

    IF you find out that something normal is going on (i.e., your server hasn't been hacked) then you might try making sure that you're not running a multithreaded mpm that's incompatible with some module (especially php). Also, check things like disk space, permissions, etc. Apache does like to give up and crash if its log files are inaccessible, but usually that happens on startup. Something similar might be happening with files that aren't opened until later (although I can't think what those files would be --- htaccess and password files should fail gracefully).

    • 0

  4. The only time I saw something like this was when the network interface was not configured and apache kinda started but just hung itself. If your system is configured to assign IP by DHCP, this could be a weakness. Of course if you are ssh'ed into same interface apache listens on, then this isn't the issue!

    Perhaps find out what is listening on port 80 this way:

    lsof -Pni | grep ":80 "
    • 0