Re: [cobalt-users] Re: 16622, zombies and sleeping processes

[Glenn Parsons <gparsons@xxxxxxxxxxxxx>]

At 02:02 PM 3/24/2004, you wrote:
> >
> > Mine shows the following so I don't think that is your problem.
> > You must have something else eating up yout cpu memory:
> > 122 processes: 121 sleeping, 1 running, 0 zombie, 0 stopped
> > CPU states:  0.9% user,  3.3% system,  0.0% nice, 95.7% idle
> > Mem:   515104K av,  230832K used,   284272K free,
> >
> >
>
> Oh, crikey.  My http reload seems to be keeping the zombies at bay.  I
> sorted my top to show memory usage, and it looks like those using the most
> memory are sleeping.  This is not a particularly busy RaQ4 as far as http
> goes, has only a very few small cgi scripts running, although it receives
> 10,000+ emails per day.  I'd have thought it anything was dragging it down
> it would be the mail, but most of these memory hogging sleepers seem to be
> httpd (and caspeng, whatever that is) ...and I don't think it was that way
> before the 16622 patch.  Anyone have any ideas what this could be?

I had what appeared to be a DoS attack last weekend that was similar. 
Something was spawning Apache threads for no apparent reason. It was 
disseminating from various IPs, one attacker at a time, and when I cut them 
off with ipchains and restarted the Apache server, it's been up and running 
for almost a week again without incident.

The only evidence I had were '408' errors showing up in 
/var/log/httpd/access. Nothing showed up in the 'error' log. I posted 
questions about this with no replies last Friday or Saturday.

Look for this sign and let me know if you find it!

Thanks,
Glenn