weird httpd processes

kalin mintchev kalin at el.net
Tue Jun 7 17:00:14 GMT 2005


hi all...

for the last 4 - 5 days i noticed something weird on one of the freebsd
boxes here. one httpd process -or sometimes 2 or 3 - take up all the cpu.
and it looks like this:

# top
CPU states: 33.1% user,  0.0% nice, 66.5% system,  0.4% interrupt,  0.0% idle
Mem: 476M Active, 295M Inact, 162M Wired, 61M Cache, 112M Buf, 7556K Free
Swap: 2032M Total, 4K Used, 2032M Free

  PID USERNAME      PRI NICE  SIZE    RES STATE    TIME   WCPU    CPU COMMAND
85655 nobody         64   0 20632K 14880K RUN    126:03 97.07% 97.07% httpd
85654 nobody          2   0 19532K 13616K sbwait   0:16  0.24%  0.24% httpd
 6081 root           28   0  2016K  1196K RUN      0:00  0.22%  0.10% top

# ps -auwx|grep httpd
.....................................
nobody   85648  0.0  1.3 19564 13848  ??  S     1:35PM   0:14.90
/etc/httpd/bin/httpd -DSSL
nobody   85647  0.0  1.2 18528 12720  ??  S     1:35PM   0:19.13
/etc/httpd/bin/httpd -DSSL
nobody   85646  0.0  1.3 19136 13320  ??  S     1:35PM   0:17.12
/etc/httpd/bin/httpd -DSSL
root     85645  0.0  0.6 12752 6472  ??  Ss    1:35PM   0:08.30
/etc/httpd/bin/httpd -DSSL
nobody   85642  0.0  0.2  3272 2096  ??  S     1:35PM   0:17.78
/usr/local/apache/bin/httpd -DSSL

nobody    1376  0.0  0.0     0    0  ??  Z     6:46AM   0:00.00  (httpd)

this last process is unexisting. to make it disappear i have to stop the
server and then killall -9 httpd it...

after i do that it's ok until i get the same. the time varies...
here for example from bsdsar from today:

#bsdsar -s
..................
09:40:
USER       PID %CPU %MEM   VSZ  RSS  TT  STAT STARTED      TIME COMMAND
 www        239  1.5  7.5 86200 78616  p0- S    28May05 121:08.51
WebCatalog -m
 root      3368  0.0  0.0   480  316  ??  R     9:40AM   0:00.00 ps -auxwwr
 root      3367  0.0  0.0   628  252  ??  S     9:40AM   0:00.00 sh -c ps
-auxwwr [PIPE] head -6
 nobody    3363  0.0  0.6 12752 6496  ??  S     9:40AM   0:00.00
/etc/httpd/bin/httpd -DSSL
 nobody    3362  0.0  0.6 12752 6496  ??  S     9:40AM   0:00.00
/etc/httpd/bin/httpd -DSSL


10:00:
USER       PID %CPU %MEM   VSZ  RSS  TT  STAT STARTED      TIME COMMAND
 nobody   85655 95.2  1.4 20632 14880  ??  R     1:35PM  11:27.22
/etc/httpd/bin/httpd -DSSL
 www        239  1.5  7.5 86200 78616  p0- S    28May05 121:16.66
WebCatalog -m
 root      3739  0.0  0.0   628  252  ??  S    10:00AM   0:00.00 sh -c ps
-auxwwr [PIPE] head -6
 root      3725  0.0  0.1  1992 1464  ??  S    10:00AM   0:00.01
/usr/bin/perl /usr/local/bin/bsdsar_gather
 root      3718  0.0  0.0   628  252  ??  Ss   10:00AM   0:00.00 /bin/sh
-c    /usr/local/bin/bsdsar_gather
...........

this si the first time it appeared today. it says it started at 1:35pm but
that's not possible since it appears for the first at 10:00 am...

i was trying to figure out if it's a connection being opened from the same
client machine all the time but i can not tell from netstat which
connection corresponds to this process...

i can't find anything unusual in the logs...

Server version: Apache/1.3.33 (Unix)
FreeBSD 4.10-RELEASE

can somebody please help explain what and why is this happening...

thanks a lot...





More information about the freebsd-questions mailing list