Apache Dying!

09/01/2008, 02h43

After the new year, the bandwidth on one of my sites went through the
roof.

Is there a way to find out what files are being accessed the most?
Maybe there is a file I have on a very very popular site that keeps
getting accessed and causing all these problems. My keepalive is on 5
seconds and timeout is at 30 seconds, but my bandwidth is at the max
that the port can handle which is making the site unusable!

This is just a SMALL portion of the netstat

0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:39653 TIME_WAIT
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:65.208.187:65152
ESTABLISHED
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:55268
TIME_WAIT
tcp 0 10220 ::ffff:68.178.207.15:80 ::ffff:24.160.240:52426
ESTABLISHED
tcp 0 20606 ::ffff:68.178.207.15:80 ::ffff:69.181.255.:3472
FIN_WAIT1
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:49639
TIME_WAIT
tcp 0 0 ::1:32981 ::1:80
TIME_WAIT
tcp 0 0 ::1:32984 ::1:80
TIME_WAIT
tcp 0 0 ::1:33008 ::1:80
TIME_WAIT
tcp 0 0 ::1:33010 ::1:80
TIME_WAIT
tcp 0 0 ::1:33012 ::1:80
TIME_WAIT
tcp 0 0 ::1:33013 ::1:80
TIME_WAIT
tcp 0 0 ::1:33014 ::1:80
TIME_WAIT
tcp 0 0 ::1:33017 ::1:80
TIME_WAIT
tcp 0 0 ::1:33021 ::1:80
TIME_WAIT
tcp 0 0 ::1:32993 ::1:80
TIME_WAIT
tcp 0 0 ::1:32994 ::1:80
TIME_WAIT
tcp 0 0 ::1:32995 ::1:80
TIME_WAIT
tcp 0 0 ::1:32996 ::1:80
TIME_WAIT
tcp 0 0 ::1:32997 ::1:80
TIME_WAIT
tcp 0 0 ::1:33002 ::1:80
TIME_WAIT
tcp 0 0 ::1:33003 ::1:80
TIME_WAIT
tcp 0 0 ::1:33004 ::1:80
TIME_WAIT
tcp 0 0 ::1:32923 ::1:80
TIME_WAIT
tcp 0 0 ::1:32924 ::1:80
TIME_WAIT
tcp 0 0 ::1:32900 ::1:80
TIME_WAIT
tcp 0 0 ::1:32902 ::1:80
TIME_WAIT
tcp 0 0 ::1:32905 ::1:80
TIME_WAIT
tcp 0 0 ::1:32908 ::1:80
TIME_WAIT
tcp 0 0 ::1:32931 ::1:80
TIME_WAIT
tcp 0 0 ::1:32932 ::1:80
TIME_WAIT
tcp 0 0 ::1:32934 ::1:80
TIME_WAIT
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:55292
TIME_WAIT
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:71.75.203.:60416
FIN_WAIT2
tcp 0 18980 ::ffff:68.178.207.15:80 ::ffff:24.170.246.:2789
ESTABLISHED
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:49659
TIME_WAIT
tcp 0 5713 ::ffff:68.178.207.15:80 ::ffff:71.130.196.:2704
FIN_WAIT1
tcp 0 11616 ::ffff:68.178.207.15:80 ::ffff:124.217.62.:4175
ESTABLISHED
tcp 1 8688 ::ffff:68.178.207.15:80 ::ffff:64.183.116.:3932
CLOSE_WAIT
tcp 0 10040 ::ffff:68.178.207.15:80 ::ffff:201.160.19.:3862
ESTABLISHED
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:74.6.28.12:36820
TIME_WAIT
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:68.178.207:32986
TIME_WAIT
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:68.178.207:32987
TIME_WAIT
tcp 0 11680 ::ffff:68.178.207.15:80 ::ffff:24.12.223.:62735
ESTABLISHED
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:68.178.207:32989
TIME_WAIT
tcp 0 14600 ::ffff:68.178.207.15:80 ::ffff:24.17.175.8:1322
ESTABLISHED
tcp 0 20328 ::ffff:68.178.207.15:80 ::ffff:75.2.24.56:3556
ESTABLISHED
tcp 0 26136 ::ffff:68.178.207.15:80 ::ffff:75.2.24.56:3559
ESTABLISHED
tcp 0 11846 ::ffff:68.178.207.15:80 ::ffff:74.197.109.:3454
FIN_WAIT1
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:12.219.126.:1335
FIN_WAIT2
tcp 0 12726 ::ffff:68.178.207.15:80 ::ffff:68.6.56.19:52100
ESTABLISHED
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:71.127.76.:50335
TIME_WAIT
tcp 0 11137 ::ffff:68.178.207.15:80 ::ffff:68.58.9.184:4489
FIN_WAIT1
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:55232
ESTABLISHED
tcp 0 20272 ::ffff:68.178.207.15:80 ::ffff:76.181.65.:50501
ESTABLISHED
tcp 0 13140 ::ffff:68.178.207.15:80 ::ffff:68.40.253.2:1286
ESTABLISHED
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:39623
TIME_WAIT
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:201.160.19.:3902
FIN_WAIT2
tcp 0 6969 ::ffff:68.178.207.15:80 ::ffff:190.166.77:58368
FIN_WAIT1
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:41430
TIME_WAIT
tcp 0 16896 ::ffff:68.178.207.15:80 ::ffff:70.234.180:58618
ESTABLISHED
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:72.23.137.:45404
TIME_WAIT
tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:66.233.224:52479
TIME_WAIT

09/01/2008, 09h05

On 2008-01-09, ameshkin <amir.meshkin@gmail.com> wrote:
> Is there a way to find out what files are being accessed the most?

Run an analyzer on the log files.
Davide

--
You are in a maze of twisty little protocols, all written by Microsoft.
--picked up from J.Hardin's signature on alt.sysadmin.recovery

09/01/2008, 11h35

"ameshkin" <amir.meshkin@gmail.com> wrote in message
news:348d11ba-e54c-4482-92cb-03f7d724c871@q39g2000hsf.googlegroups.com...
> After the new year, the bandwidth on one of my sites went through the
> roof.
>
> Is there a way to find out what files are being accessed the most?
> Maybe there is a file I have on a very very popular site that keeps
> getting accessed and causing all these problems. My keepalive is on 5
> seconds and timeout is at 30 seconds, but my bandwidth is at the max
> that the port can handle which is making the site unusable!
>

Davide is right with his answer, although, in my experience, requests don't
make it as far as the log until after they have been processed. I had a
problem a while ago with a script that didn't finish - so there were no log
entries.

If you are running apache on a linux machine (other *nix boxes may have
similar answers) you can try the following to see which directory an apache
process is accessing:

ls -l `ps -C httpd h | sed -r "s/^\s*([0-9]+) .+$/\/proc\/\\1\/cwd/"`

(NOTE: the single quote marks are backticks)

09/01/2008, 11h55

On 2008-01-09, phantom <nobody@blueyonder.invalid> wrote:
> Davide is right with his answer, although, in my experience, requests don't
> make it as far as the log until after they have been processed.

You're right. In that case the best option would be to interrogate
the 'server-status' page that gives in real time what's the server up
to.

Davide

--
I have identified this service to be a scam using the "superfluous female
person standing next to logo" method.
-- BillX on /.

09/01/2008, 12h13

"Davide Bianchi" <davideyeahsure@onlyforfun.net> wrote in message
news:slrnfo9djv.37k.davideyeahsure@fogg.onlyforfun .net...
> On 2008-01-09, phantom <nobody@blueyonder.invalid> wrote:
>> Davide is right with his answer, although, in my experience, requests
>> don't
>> make it as far as the log until after they have been processed.
>
> You're right. In that case the best option would be to interrogate
> the 'server-status' page that gives in real time what's the server up
> to.
>
> Davide
>

*learns something new*
Cheers Davide.

09/01/2008, 02h43	#1
ameshkin Messages: n/a Hébergeur:	Apache Dying! After the new year, the bandwidth on one of my sites went through the roof. Is there a way to find out what files are being accessed the most? Maybe there is a file I have on a very very popular site that keeps getting accessed and causing all these problems. My keepalive is on 5 seconds and timeout is at 30 seconds, but my bandwidth is at the max that the port can handle which is making the site unusable! This is just a SMALL portion of the netstat 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:39653 TIME_WAIT tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:65.208.187:65152 ESTABLISHED tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:55268 TIME_WAIT tcp 0 10220 ::ffff:68.178.207.15:80 ::ffff:24.160.240:52426 ESTABLISHED tcp 0 20606 ::ffff:68.178.207.15:80 ::ffff:69.181.255.:3472 FIN_WAIT1 tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:49639 TIME_WAIT tcp 0 0 ::1:32981 ::1:80 TIME_WAIT tcp 0 0 ::1:32984 ::1:80 TIME_WAIT tcp 0 0 ::1:33008 ::1:80 TIME_WAIT tcp 0 0 ::1:33010 ::1:80 TIME_WAIT tcp 0 0 ::1:33012 ::1:80 TIME_WAIT tcp 0 0 ::1:33013 ::1:80 TIME_WAIT tcp 0 0 ::1:33014 ::1:80 TIME_WAIT tcp 0 0 ::1:33017 ::1:80 TIME_WAIT tcp 0 0 ::1:33021 ::1:80 TIME_WAIT tcp 0 0 ::1:32993 ::1:80 TIME_WAIT tcp 0 0 ::1:32994 ::1:80 TIME_WAIT tcp 0 0 ::1:32995 ::1:80 TIME_WAIT tcp 0 0 ::1:32996 ::1:80 TIME_WAIT tcp 0 0 ::1:32997 ::1:80 TIME_WAIT tcp 0 0 ::1:33002 ::1:80 TIME_WAIT tcp 0 0 ::1:33003 ::1:80 TIME_WAIT tcp 0 0 ::1:33004 ::1:80 TIME_WAIT tcp 0 0 ::1:32923 ::1:80 TIME_WAIT tcp 0 0 ::1:32924 ::1:80 TIME_WAIT tcp 0 0 ::1:32900 ::1:80 TIME_WAIT tcp 0 0 ::1:32902 ::1:80 TIME_WAIT tcp 0 0 ::1:32905 ::1:80 TIME_WAIT tcp 0 0 ::1:32908 ::1:80 TIME_WAIT tcp 0 0 ::1:32931 ::1:80 TIME_WAIT tcp 0 0 ::1:32932 ::1:80 TIME_WAIT tcp 0 0 ::1:32934 ::1:80 TIME_WAIT tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:55292 TIME_WAIT tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:71.75.203.:60416 FIN_WAIT2 tcp 0 18980 ::ffff:68.178.207.15:80 ::ffff:24.170.246.:2789 ESTABLISHED tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:49659 TIME_WAIT tcp 0 5713 ::ffff:68.178.207.15:80 ::ffff:71.130.196.:2704 FIN_WAIT1 tcp 0 11616 ::ffff:68.178.207.15:80 ::ffff:124.217.62.:4175 ESTABLISHED tcp 1 8688 ::ffff:68.178.207.15:80 ::ffff:64.183.116.:3932 CLOSE_WAIT tcp 0 10040 ::ffff:68.178.207.15:80 ::ffff:201.160.19.:3862 ESTABLISHED tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:74.6.28.12:36820 TIME_WAIT tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:68.178.207:32986 TIME_WAIT tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:68.178.207:32987 TIME_WAIT tcp 0 11680 ::ffff:68.178.207.15:80 ::ffff:24.12.223.:62735 ESTABLISHED tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:68.178.207:32989 TIME_WAIT tcp 0 14600 ::ffff:68.178.207.15:80 ::ffff:24.17.175.8:1322 ESTABLISHED tcp 0 20328 ::ffff:68.178.207.15:80 ::ffff:75.2.24.56:3556 ESTABLISHED tcp 0 26136 ::ffff:68.178.207.15:80 ::ffff:75.2.24.56:3559 ESTABLISHED tcp 0 11846 ::ffff:68.178.207.15:80 ::ffff:74.197.109.:3454 FIN_WAIT1 tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:12.219.126.:1335 FIN_WAIT2 tcp 0 12726 ::ffff:68.178.207.15:80 ::ffff:68.6.56.19:52100 ESTABLISHED tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:71.127.76.:50335 TIME_WAIT tcp 0 11137 ::ffff:68.178.207.15:80 ::ffff:68.58.9.184:4489 FIN_WAIT1 tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:55232 ESTABLISHED tcp 0 20272 ::ffff:68.178.207.15:80 ::ffff:76.181.65.:50501 ESTABLISHED tcp 0 13140 ::ffff:68.178.207.15:80 ::ffff:68.40.253.2:1286 ESTABLISHED tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:39623 TIME_WAIT tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:201.160.19.:3902 FIN_WAIT2 tcp 0 6969 ::ffff:68.178.207.15:80 ::ffff:190.166.77:58368 FIN_WAIT1 tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:38.98.19.6:41430 TIME_WAIT tcp 0 16896 ::ffff:68.178.207.15:80 ::ffff:70.234.180:58618 ESTABLISHED tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:72.23.137.:45404 TIME_WAIT tcp 0 0 ::ffff:68.178.207.15:80 ::ffff:66.233.224:52479 TIME_WAIT

09/01/2008, 09h05	#2
Davide Bianchi Messages: n/a Hébergeur:	Re: Apache Dying! On 2008-01-09, ameshkin <amir.meshkin@gmail.com> wrote: > Is there a way to find out what files are being accessed the most? Run an analyzer on the log files. Davide -- You are in a maze of twisty little protocols, all written by Microsoft. --picked up from J.Hardin's signature on alt.sysadmin.recovery

09/01/2008, 11h35	#3
phantom Messages: n/a Hébergeur:	Re: Apache Dying! "ameshkin" <amir.meshkin@gmail.com> wrote in message news:348d11ba-e54c-4482-92cb-03f7d724c871@q39g2000hsf.googlegroups.com... > After the new year, the bandwidth on one of my sites went through the > roof. > > Is there a way to find out what files are being accessed the most? > Maybe there is a file I have on a very very popular site that keeps > getting accessed and causing all these problems. My keepalive is on 5 > seconds and timeout is at 30 seconds, but my bandwidth is at the max > that the port can handle which is making the site unusable! > Davide is right with his answer, although, in my experience, requests don't make it as far as the log until after they have been processed. I had a problem a while ago with a script that didn't finish - so there were no log entries. If you are running apache on a linux machine (other nix boxes may have similar answers) you can try the following to see which directory an apache process is accessing: ls -l `ps -C httpd h \| sed -r "s/^\s([0-9]+) .+$/\/proc\/\\1\/cwd/"` (NOTE: the single quote marks are backticks)

09/01/2008, 11h55	#4
Davide Bianchi Messages: n/a Hébergeur:	Re: Apache Dying! On 2008-01-09, phantom <nobody@blueyonder.invalid> wrote: > Davide is right with his answer, although, in my experience, requests don't > make it as far as the log until after they have been processed. You're right. In that case the best option would be to interrogate the 'server-status' page that gives in real time what's the server up to. Davide -- I have identified this service to be a scam using the "superfluous female person standing next to logo" method. -- BillX on /.

09/01/2008, 12h13	#5
phantom Messages: n/a Hébergeur:	Re: Apache Dying! "Davide Bianchi" <davideyeahsure@onlyforfun.net> wrote in message news:slrnfo9djv.37k.davideyeahsure@fogg.onlyforfun .net... > On 2008-01-09, phantom <nobody@blueyonder.invalid> wrote: >> Davide is right with his answer, although, in my experience, requests >> don't >> make it as far as the log until after they have been processed. > > You're right. In that case the best option would be to interrogate > the 'server-status' page that gives in real time what's the server up > to. > > Davide > learns something new Cheers Davide.

Outils de la discussion
Afficher une version imprimable Envoyer un lien vers cette page par email