Apache: Graceful kill fail, sending SIGKILL

[ehrenwert]

Hello,

last 2 days I mention a large number of these entries in my apache-logfiles:

[Sun Nov 22 18:41:42.335043 2015] [:error] [pid 30603:tid 140626381186816] [client 64.246.165.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/modsecurity.d/rules/comodo/02_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler"] [data "SurveyBot"] [severity "WARNING"] [hostname "www.xxxxx.de"] [uri "/"] [unique_id "VlH@Vn8AAAEAAHeLIs8AAAAN"]

[Sun Nov 22 19:09:53.571745 2015] [cgi:error] [pid 30603:tid 140626297259776] [client 115.231.222.14:56480] script not found or unable to stat: /var/www/vhosts/default/cgi-bincommon

[Sun Nov 22 19:24:41.452082 2015] [fcgid:warn] [pid 30602:tid 140626885568384] mod_fcgid: process 14022 graceful kill fail, sending SIGKILL

[Sun Nov 22 19:36:03.298582 2015] [fcgid:warn] [pid 30602:tid 140626885568384] mod_fcgid: process 14641 graceful kill fail, sending SIGKILL

[Sun Nov 22 19:50:00.772218 2015] [cgi:error] [pid 30603:tid 140626481899264] [client 115.231.222.14:36470] script not found or unable to stat: /var/www/vhosts/default/cgi-bincommon

[Sun Nov 22 19:54:41.869619 2015] [fcgid:warn] [pid 30602:tid 140626885568384] mod_fcgid: process 15901 graceful kill fail, sending SIGKILL

[Sun Nov 22 21:17:28.302078 2015] [fcgid:warn] [pid 30602:tid 140626885568384] mod_fcgid: process 21099 graceful kill fail, sending SIGKILL

[Sun Nov 22 21:28:03.670896 2015] [cgi:error] [pid 30603:tid 140626473506560] [client 115.231.222.14:38858] script not found or unable to stat: /var/www/vhosts/default/cgi-bincommon

[Sun Nov 22 21:34:08.083550 2015] [fcgid:warn] [pid 30602:tid 140626885568384] mod_fcgid: process 22202 graceful kill fail, sending SIGKILL

[Sun Nov 22 21:40:20.794153 2015] [fcgid:warn] [pid 30602:tid 140626885568384] mod_fcgid: process 22554 graceful kill fail, sending SIGKILL

[Sun Nov 22 21:43:48.777451 2015] [fcgid:warn] [pid 30602:tid 140626885568384] mod_fcgid: process 22808 graceful kill fail, sending SIGKILL

At first I thought about raising MaxClients limit but this does not solve the problem at the moment:

/etc/apache2/conf.d/additional.conf

<IfModule worker.c>

#       HostnameLookups off

#       KeepAlive Off



#       StartServers 1

#       ServerLimit 2

#       MinSpareThreads 32

#       MaxSpareThreads 96

#       ThreadLimit 64

#       ThreadsPerChild 32

#       ThreadStackSize 2097152

#       MaxClients 150

#       MaxRequestsPerChild 0



        KeepAlive               On

        MaxKeepAliveRequests    10

        KeepAliveTimeout        2



        StartServers            10

        MinSpareThreads         25

        MaxSpareThreads         75



        ThreadLimit             64

        ThreadsPerChild         25



        MaxClients              200

        MaxRequestsPerChild     100

</IfModule>

Any other ideas?

 

[IgorG]

Have you seen this KB article http://kb.odin.com/en/119314 ?

 

[ehrenwert]

Hi Igor,

yes, I have seen this and I increased

MaxClients 200

So the only way to get out of these messages is to increase the limit again?