• Please be aware: Kaspersky Anti-Virus has been deprecated
    With the upgrade to Plesk Obsidian 18.0.64, "Kaspersky Anti-Virus for Servers" will be automatically removed from the servers it is installed on. We recommend that you migrate to Sophos Anti-Virus for Servers.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

Apache dummy connections

T

TonyM78

Guest
Hey all,
I'm experiencing something weird.
About a month ago we have completely redesigned one of our clients website.
About 3 days later Apache was down. Checked the err_logs and it showed that MaxClients limit was reached.
Increased it from 256to 1024. This kept the server up for about a week after which it crashed again.
I installed mod_status and initially everything looked fine.
Though I realized 24 hrs later that it was ok initially because I checked it right after a server reboot.
so 24 hrs later I began to see these:

38-0 - 0/0/4 . 0.00 6055 0 0.0 0.00 0.06 ::1 xx1987.xxx.xxxxx.com OPTIONS * HTTP/1.0

where xx1987.xxx.xxxxx.com is the server name assigned by the datacenter.

I did a bit of research and everyone said these are harmless and they can be ignored as they are just dummy connections from the server itself checking on Apache to see whether it's up or not.
The status of these requests do seem to be "." Open slot with no current process, but what worries me is that they keep stacking up.
After 24 hrs there were only 18, after 48 hrs there were 54, after 72hrs there were 172 of these.
So I'm thinking that these may actually clog apache and cause it to hit its maxclients limit and crash.

The error logs only show when maxclients was reached and crashed nothing else.

Furthermore, I don't think the redesign of the clients website is causing this as the requests coming through that domain seem to process just fine, close and disappear after a couple of minutes.
While these requests that keep staying on seem to be made directly through the server name assigned by the datacenter.

Any idea what may cause this or any suggestions on how to further track this down?

Thank you for your time and have a great day all.

T
 
Back
Top