How am I able to figure out why apache/php crashes

log-filesloggingwindows-event-log

I have a problem which is driving me and a few clients on this server totally nuts.

The problem is that PHP (or I guess Apache) seems to be crashing randomly and almost on a daily basis.

The dedicated server I have is running Linux and Plesk 9.5 and has 1gb of ram and is only really running 5 websites which don't get a significant amount of traffic.

I have gone through the httpd error_log as the web host suggested and I did find a bunch of issues being reported by php for each of the 5 wordpress 3.0 sites. Mainly related to missing php include files and things like that all which I ended up resolving.

Unfortunately, none of the issue I fixed seem to have been related to apache crashing so my question to you guys here is what do I do next.

Naturally I would like to know exactly why this is happening so I can not only resolve this problem right now but also know how to correctly diagnose a problem like this in the future.

My web hosts solution was to just add more ram but although this "may" be the actual reason I can't believe these 5 sites are sucking so much ram.

In any case I am just looking for the exact steps you experts would use to diagnose and resolve this.

Additionally – Below I have included a few bullet points for other unresolved errors listed within my errors_log file as I don't know if any of this is helpful.

[Mon Dec 13 17:00:53 2010] [warn]
Init: You should not use name-based
virtual hosts in conjunction with
SSL!! [Mon Dec 13 17:00:54 2010]
[notice] ModSecurity for Apache 2.1.7
configured – Apache/2.2.8 (Fedora)
[Mon Dec 13 17:00:54 2010] [warn]
module jk_module is already loaded,
skipping [Mon Dec 13 17:00:54 2010]
[warn] module ssl_module is already
loaded, skipping [Mon Dec 13 17:00:54
2010] [notice] Digest: generating
secret for digest authentication …
[Mon Dec 13 17:00:54 2010] [notice]
Digest: done [Mon Dec 13 17:00:54
2010] [warn] RSA server certificate
CommonName (CN) plesk' does NOT match
server name!? [Mon Dec 13 17:00:54
2010] [warn] RSA server certificate
CommonName (CN)
domain****.com' does NOT
match server name!? [Mon Dec 13
17:00:54 2010] [warn] RSA server
certificate CommonName (CN)
domain****.com' does NOT
match server name!? [Mon Dec 13
17:00:54 2010] [warn] RSA server
certificate CommonName (CN)
domain****.com' does NOT
match server name!? [Mon Dec 13
17:00:54 2010] [warn] Init: SSL server
IP/port conflict: atmail.webmail:443
(/etc/httpd/conf.d/zzz_atmail_vhost.conf:48)
vs. horde.webmail:443
(/etc/httpd/conf.d/zzz_horde_vhost.conf:41)
[Mon Dec 13 17:00:54 2010] [warn]
Init: SSL server IP/port conflict:
wp3.excitesteps.com:443
(/var/www/vhosts/domain****.com/conf/httpd.include:13)
vs. horde.webmail:443
(/etc/httpd/conf.d/zzz_horde_vhost.conf:41)
[Mon Dec 13 17:00:54 2010] [warn]
Init: SSL server IP/port conflict:
domain******.com:443
(/var/www/vhosts/domain******.com/conf/httpd.include:13)
vs. horde.webmail:443
(/etc/httpd/conf.d/zzz_horde_vhost.conf:41)
[Mon Dec 13 17:00:54 2010] [warn]
Init: SSL server IP/port conflict:
domain******.com:443
(/var/www/vhosts/domain******.com/conf/httpd.include:13)
vs. horde.webmail:443
(/etc/httpd/conf.d/zzz_horde_vhost.conf:41)
[Mon Dec 13 17:00:54 2010] [warn]
Init: SSL server IP/port conflict:
default-2**-1**-2**-2**:443
(/etc/httpd/conf.d/zz010_psa_httpd.conf:84)
vs. horde.webmail:443
(/etc/httpd/conf.d/zzz_horde_vhost.conf:41)
[Mon Dec 13 17:00:54 2010] [warn]
Init: You should not use name-based
virtual hosts in conjunction with
SSL!! [Mon Dec 13 17:00:54 2010]
[notice] mod_bw : Memory Allocated 0
bytes (each conf takes 32 bytes) [Mon
Dec 13 17:00:54 2010] [notice] mod_bw
: Version 0.8 – Initialized [0 Confs]
[Mon Dec 13 17:00:55 2010] [notice]
mod_python: Creating 4 session mutexes
based on 256 max processes and 0 max
threads. [Mon Dec 13 17:00:55 2010]
[notice] mod_python: using
mutex_directory /tmp [Mon Dec 13
17:00:55 2010] [notice] Apache/2.2.8
(Unix) DAV/2 mod_jk/1.2.15
mod_ssl/2.2.8 OpenSSL/0.9.8b
mod_auth_kerb/5.3 mod_auth_pgsql/2.0.3
Apache/2.2.0 (Fedora) PHP/5.2.6
mod_python/3.3.1 Python/2.5
mod_perl/2.0.3 Perl/v5.8.8 configured
— resuming normal operations [Mon Dec 13 18:09:26 2010] [error] [client
6**.5**.3**.1**] File does not exist: /usr/share/psa-horde/robots.txt [Mon
Dec 13 18:09:27 2010] [error] [client
6**.5**.3**.1**] ModSecurity: Could not set variable
"resource.alerted_960903_compression"
as the collection does not exist.
[hostname "webmail.domain****.com"]
[uri "/index.php"] [unique_id
"T2ObHH8AAAEAACAU36UAAAAA"] [Mon Dec
13 18:09:27 2010] [error] [client
6**.5**..1] ModSecurity: Warning. Operator EQ match: 0. [id "960903"]
[msg "ModSecurity does not support
content encodings"] [severity
"WARNING"] [hostname
"webmail.domain****.com"] [uri
"/index.php"] [unique_id
"T2ObHH8AAAEAACAU36UAAAAA"] [Mon Dec
13 18:09:28 2010] [error] [client
6**.5**.3**.1**] ModSecurity: Could not set variable
"resource.alerted_960903_compression"
as the collection does not exist.
[hostname "webmail.domain******.com"]
[uri "/login.php"] [unique_id
"T3@Qcn8AAAEAACAa6v8AAAAG"] [Mon Dec
13 18:09:28 2010] [error] [client
6**.5**.3**.1**] ModSecurity: Warning. Operator EQ match: 0. [id "960903"]
[msg "ModSecurity does not support
content encodings"] [severity
"WARNING"] [hostname
"webmail.domain****.com"] [uri
"/login.php"] [unique_id
"T3@Qcn8AAAEAACAa6v8AAAAG"] [Mon Dec
13 18:09:30 2010] [error] [client
6**.5**.3**.1**] ModSecurity: Warning. Operator EQ match: 0. [id "960903"]
[msg "ModSecurity does not support
content encodings"] [severity
"WARNING"] [hostname
"webmail.domain******.com"] [uri
"/imp/login.php"] [unique_id
"T5LVI38AAAEAACAb7LUAAAAH"]

All help would be greatly appreciated

Best Answer

Assuming you've already checked for bugs/updates for all the packaged software you're running...

If you've not already done so, configure your server to save core files and get a stack trace from a crash using gdb, e.g. 'gdb /usr/sbin/httpd core' then enter bt at the prompt.

Its probably a very specific request which is causing the error - IIRC, both the access and error log are written after processing completes - IIRC mod_security can log requests when they arrive (including post vars) - switching this on would be a good idea until you know what causes the crash.