Member Avatar for asleep@the_keys

I am having a problem with Apache version 2.053 running with PHP 4.3.10. This install of Apache is running on an XP professional installation service pack 2. The problem is that anywhere from 1 day to 6 days, (which I don't think the number of day matters) Apache will begin to refuse port 80 requsts and will not allow my users access to the server. I have been running this web server for a number of years now, but recently migrated to a new machine and new OS install and upgraded apache and the rest of my server softwares when I made the change, (I know, alot of variable all at once), but everything else seems to be ok, except for this problem. I looked at my log files after every occurence, and it seems that there are indications of search engine spiders (non malicious), and either spider hits to my webmail page, or a user on my webmail page around the same time. My webmail installation runs on IIS on the same machine, and apache proxies the request to IIS when the user calls it up.

Does anyone have any ideas?

  • 3 Contributors
  • 6 Replies
  • 407 Views
  • 3 Weeks Discussion Span
  • Latest Post Latest Post by DanceInstructor

Dani AI

Generated

Good isolation work by — the pattern (intermittent “connection refused”, absence of an error in Apache logs, and mod_proxy errors) strongly points to Apache or the Windows networking stack stopping to accept connections rather than a pure network path problem. “Connection refused” normally means there’s no process listening on port 80; mod_proxy “error reading status line” messages show Apache couldn’t get a valid response from the backend (IIS) at the time. (help.dyn.com)

Quick, repeatable checks to capture the failure

  • Immediately when it happens: confirm whether port 80 is listening and which PID owns it:

    netstat -ano | find ":80"

  • Watch connections while you load-test (or while a spider is crawling): netstat -o 5 or use Sysinternals TCPView to see the owning process and connection states in real time. Capture a ProcMon trace or Process Explorer snapshot if the Apache process exits unexpectedly. Run a controlled load test (ab/siege/httperf) against localhost so you can reproduce without external DNS/NAT variables. (learn.microsoft.com)

Why some personal firewalls bite servers (and what to use instead)
Third‑party personal firewalls often insert hooks into the Windows networking stack and can behave poorly under concurrent server loads; NIST and other guidance recommend host‑ and network‑level controls used together, but note host firewalls can interfere if misconfigured. For public servers the best practice is a perimeter firewall (router / appliance) in front of the host and a minimal host firewall configured only with required exceptions. For small sites, a dedicated appliance or an open‑source edge firewall (for example pfSense) gives far better isolation than running a desktop personal‑firewall on the web host. ()

Actionable next steps (do these in order)

  1. Reproduce under load and capture netstat/TCPView + ProcMon while it fails.
  2. Set the Apache Windows service Recovery to “Restart the service” for first/second/subsequent failures (Services.msc → Recovery) so the site comes back automatically.
  3. If using mod_proxy to IIS, add timeouts / avoid pooled‑connection races (example):
  SetEnv proxy-initial-not-pooled 1
  ProxyPass /mail http://127.0.0.1:8080/ disablereuse=On
  ProxyTimeout 60
  1. Test with the third‑party firewall disabled briefly (but only while the host is behind a router/firewall), and if stability returns, either replace it with the built‑in firewall + perimeter device or move to a server‑grade appliance. Also follow up by collecting an Apache error_log, Windows Event Viewer entries, and any crash dumps if the process exits. (flylib.com)

Useful links

Following the checklist above will show whether Apache is crashing, being blocked, or suffering resource exhaustion; that determines the permanent fix (tune Apache MPM/threads, remove the offending firewall driver, or move the service behind a proper perimeter firewall).

Recommended Answers

All 6 Replies

Member Avatar for blud

Well, the real question we need to know before starting to troubleshoot thism is what error message does it give when it stops responding, if it gives a 'connection refused' then it probably has something to do with the program crashing, and you should check the error_log or the event viewer. *I'm assuming you have windows since you said you were running IIS*. If it just times out, you may want to look into the max clients configuration and make sure that it is not being met. You can see the number of simutanious requests in the 'netstat -an' command. If they are being met, try to lower the timeout, or increase the number of connections.

Member Avatar for asleep@the_keys

Thank you for responding. This problem is driving me nuts. Yes the apache installation is running on windows, XP Pro SP2 to be exact. I don't know what to look for when the failure occurs, as no error messages show up in the error log. I even changed the log level to show everything, and still no errors right at the time of the 'crash' seem to be appearing. Other than missing content, or people trying to poke around my server, I am only seeing one type of error come up at all, which does not seem to be associated with the crash. It says [error] [Client ] proxy: error reading status line from remote server , referer: blah and then an error right after stating [error] [] Error reading from remote server returned by /, referer: blah I don't know if there is any association of this error, with my problem, but it does seem to be showing up in my logs. The logs seem to be consistent in showing mail activity (which is done through a proxy to IIS), and spider activity right around the times of the crashes. I have used 3rd party tests on my sites when appache is down, and the tests state that apache is found, but the errer thrown back is "connection refused".

Member Avatar for blud

The last error, connection refused, means that apache is indeed actually hard failing, and not listening on port 80, if apache is configured as a service, you might want to make sure that the setting for what to do when the service fails is "restart". By default this is set to 'do nothing'.

Member Avatar for asleep@the_keys

Thank you for the tip about setting up the apache service to restart after failures, hopefully this will keep the server up more than down. I had another crash yesterday, and the log files are only showing spider activity from two different search engines, right around the time of the crash. I restarted the apache service when I found out about the crash, and it resumed normal opperation. What could possibly be causing apache to crash when spidered?

Member Avatar for asleep@the_keys

After countless research, I believe I may have found the root of the problem. After seeing that spiders were crashing my server, I load tested it and found that the server was crashing under a light to moderate load. I then started digging to find issues with my firewall. Like many others, I was running zonealarm software (hey its free), and had no previous problems. But after removing this software from my server, all of my load tests had very positive results, I will yet have to see if the server stays up for more than a week, but I have a feeling it will. Does anyone have any suggestions as to what firewall I should be running on this winxp pro sp2 / apache box?

Member Avatar for DanceInstructor

Why not try the windows firewall while you search for another....

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.