The Web server encountered a strange problem, in the running of many apache2 process, there will be a process, slowly occupied full memory, and then the machine is like dead, Write an automatic check script, check and kill the problem of the apache2 process, the issue is mitigated, but not resolved, because slowly fill up the memory, will make Linux release the hard disk cache and cyclical performance degradation. Limiting memory with RLIMITMEM parameters does not work, and bw_mod limiting traffic does not work
Today modified the script, before killing the problem process, record this process to connect the external IP and port, &http://www.aliyun.com/zixun/aggregation/37954.html ">NBSP;" and modify the Apache log format to increase the process number field. Check the Access.log log of the faulty process number and find no specific URL access.
The offending process is connected to an external IP that is 2 IP, and these 2 IP agent fields declare that they are from Sogou and are Sogou robots. With tcpdump to these 2 IP grab bag (tcpdump host 220.181.94.213-s0-w/home/sogou.cap), with Wireshark look grab bag content, traffic is very small, also nothing special.
Monitoring record script:
#!/bin/sh While [1] Do Ps-u www-data-u www-data-u root-u root U |grep apache2 read user PID CPU mem Other Do if [${mem%\.*} GT 15] Then ip=$ (netstat-npa |grep $pid |tr ': ' |awk ' {printf $} ') echo ' Date +%y-%m-%d:%h:%m:%s ' kill PID: $pid CPU: $CPU mem: $MEM IP: $ip >>/var/log/apache2/autokill.log Kill-9 $pid Fi Done Sleep 30 Done
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.