Ubuntu EC2 Apache 2 : Access Log only shows Internal Dumthe Connection

amazon ec2apache-2.2log-filesUbuntu

I'm running a micro instance on Amazon Cloud Services, and a recent spike made our web server unresponsive, I'm trying to do a little research to determine if this was a DOS attack, or which process was hogging down the server.

I checked the Apache Access Log and all I see are Internal Dummy Connections from local IP

127.0.0.1 - - [18/Feb/2013:18:51:20 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"

that's an example, and I noticed when I tail the log file while refreshing the site, it adds a new record.

Why can't I see the remote IP that's connecting to the IP, and how can I better track down this issue?

Best Answer

Those "dummy" connections are the way Apache tells its child processed that the have to die.

Have a look at: http://www.thewebhelp.com/apache/internal-dummy-connection/

Related Solutions

Apache access log rotation

You probably have something looking like this in your logrotate configuration file

"/var/log/httpd/access.log" /var/log/httpd/error.log {
           rotate 5
           size=100k
           sharedscripts
           postrotate
                                     /sbin/killall -HUP httpd
           endscript
       }

rotate 5 means that only last 5 files will be keept. Here file are turned every 100k.
if you have the daily keyword it means that each archived file is 1 day of log. If you want to keep file longer on the server you have to increase the rotate value

High-traffic Drupal site apache errors

This is a wild ass guess but have you checked how many on-disk temporary tables Drupal is creating?

I have seen this cause iowait (load) problems.

mysqladmin -u root -p ext -ri 30 | grep Created_tmp_disk

First run will tell you how many on-disk temporary tables were created since last restart of MySQL. Then it will tell you how many are created in the 30 seconds time window (until you Control-C out of it).

The (band-aid) solution is to put MySQL's tmpdir on a RAM based file system (e.g. tmpfs).

I guess what I'm suggesting is that this starts the cascade - and the messages you're seeing are just abandoned connections.

Cheers

Best Answer

Related Solutions

Apache access log rotation

High-traffic Drupal site apache errors

Related Topic