Resolved Apache server stops working again and again

[Cordal]

For a few days the apache service stops, intermittently, I restart it and it works correctly until it stops working again, inverted in the error log of apache these are the lines that appear just before stopping:


[Fri Jan 04 03:39:46.000595 2019] [mpm_prefork:notice] [pid 24244] AH00163: Apache/2.4.10 (Debian) mod_fcgid/2.3.9 OpenSSL/1.0.1t configured -- resuming normal operations
[Fri Jan 04 03:39:46.000607 2019] [core:notice] [pid 24244] AH00094: Command line: '/usr/sbin/apache2'
[Fri Jan 04 05:21:38.652601 2019] [mpm_prefork:error] [pid 24244] AH00161: server reached MaxRequestWorkers setting, consider raising the MaxRequestWorkers setting
[Fri Jan 04 09:41:22.240587 2019] [mpm_prefork:notice] [pid 24244] AH00169: caught SIGTERM, shutting down

To which I have modified the file /etc/apache2/mods-enabled/mpm_prefork.conf increasing the /etc/apache2/mods-enabled/mpm_prefork.conf from 100 to 250 and adding the ServerLimit to 250 as well, leaving the file of the following way:

<IfModule mpm_prefork_module>
StartServers 5
MinSpareServers 5
MaxSpareServers 150
MaxRequestWorkers 250
ServerLimit 250
MaxConnectionsPerChild 0
</IfModule>

I have restarted the apache service after said modification, but after a few hours the service stops again.

Can someone give me some clue?

Thank you.

 

[Brujo]

as a starting point see the following Knowledgebase entry: Apache keeps going down on a Plesk server: server reached MaxRequestWorkers setting & Apache restarts frequently on Plesk running server: Caught SIGTERM, shutting down

 

[Cordal]

Thanks for your answer, I have uploaded the parameter to 350 and hopefully it will be solved.

 

[Bitpalast]

I'd change MaxConnectionsPerChild to a value like 1000 to 10000. When this is "0", an Apache instances resides in memory infinitely long. This includes crashed instances. It is better to have an instance close and start a new one later than to never close an instance.

Then also make sure that you are using Fail2Ban to block IP addresses of bad bots and other useless and bad stuff, like brute force attacks. These cause an awful lot of load and normally cause many Apache instances. 350 instances is a lot for a normal server. For single websites, numbers like "20" would do, for a server with for example 300 customers and up to 1000 domains, 250 instances will normally do. If your server crashes and does not have theses numbers of subscriptions or domains on them, it is probably because of some DDoS attack or similar behavior.

 

[Cordal]

Thanks for your answer, I have the fail2ban active, so far with the parameter at 350 has not returned to present problems, with about 190 domains.

 

[Cordal]

It has come back to stop, I am continually pending connections with:

netstat -an | egrep ':80|:443' | grep ESTABLISHED | awk '{print $5}' | grep -o -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}" | sort -n | uniq -c | sort -nr

but there are always very low values, so I'm thinking that there must be some website that collapses the service, how could I find out what web is?

 

[Brujo]

what about the extension repair kit - when installed it provides under Tools & Settings the Process list
This is the list of processes which can help you to identify the main resource-eaters

 

[Cordal]

I do not know what you mean, how can I install it, can you give me more information about that?

 

[Brujo]

How to install or remove an extension in Plesk
the extension in the catalogue is called repair kit