Apache Intermittently Refuses Port 80

[asleep@the_keys]

I am having a problem with Apache version 2.053 running with PHP 4.3.10. This install of Apache is running on an XP professional installation service pack 2. The problem is that anywhere from 1 day to 6 days, (which I don't think the number of day matters) Apache will begin to refuse port 80 requsts and will not allow my users access to the server. I have been running this web server for a number of years now, but recently migrated to a new machine and new OS install and upgraded apache and the rest of my server softwares when I made the change, (I know, alot of variable all at once), but everything else seems to be ok, except for this problem. I looked at my log files after every occurence, and it seems that there are indications of search engine spiders (non malicious), and either spider hits to my webmail page, or a user on my webmail page around the same time. My webmail installation runs on IIS on the same machine, and apache proxies the mail.site.com request to IIS when the user calls it up.

Does anyone have any ideas?

[blud]

Well, the real question we need to know before starting to troubleshoot thism is what error message does it give when it stops responding, if it gives a 'connection refused' then it probably has something to do with the program crashing, and you should check the error_log or the event viewer. *I'm assuming you have windows since you said you were running IIS*. If it just times out, you may want to look into the max clients configuration and make sure that it is not being met. You can see the number of simutanious requests in the 'netstat -an' command. If they are being met, try to lower the timeout, or increase the number of connections.

[asleep@the_keys]

Thank you for responding. This problem is driving me nuts. Yes the apache installation is running on windows, XP Pro SP2 to be exact. I don't know what to look for when the failure occurs, as no error messages show up in the error log. I even changed the log level to show everything, and still no errors right at the time of the 'crash' seem to be appearing. Other than missing content, or people trying to poke around my server, I am only seeing one type of error come up at all, which does not seem to be associated with the crash. It says [error] [Client 012.345.6.789] proxy: error reading status line from remote server 012.345.6.789, referer: http://www.blah blah blah.com and then an error right after stating [error] [012.345.6.789] Error reading from remote server returned by /, referer: http://www.blah blah blah.com I don't know if there is any association of this error, with my problem, but it does seem to be showing up in my logs. The logs seem to be consistent in showing mail activity (which is done through a proxy to IIS), and spider activity right around the times of the crashes. I have used 3rd party tests on my sites when appache is down, and the tests state that apache is found, but the errer thrown back is "connection refused".

[blud]

The last error, connection refused, means that apache is indeed actually hard failing, and not listening on port 80, if apache is configured as a service, you might want to make sure that the setting for what to do when the service fails is "restart". By default this is set to 'do nothing'.

[asleep@the_keys]

Thank you for the tip about setting up the apache service to restart after failures, hopefully this will keep the server up more than down. I had another crash yesterday, and the log files are only showing spider activity from two different search engines, right around the time of the crash. I restarted the apache service when I found out about the crash, and it resumed normal opperation. What could possibly be causing apache to crash when spidered?

[asleep@the_keys]

After countless research, I believe I may have found the root of the problem. After seeing that spiders were crashing my server, I load tested it and found that the server was crashing under a light to moderate load. I then started digging to find issues with my firewall. Like many others, I was running zonealarm software (hey its free), and had no previous problems. But after removing this software from my server, all of my load tests had very positive results, I will yet have to see if the server stays up for more than a week, but I have a feeling it will. Does anyone have any suggestions as to what firewall I should be running on this winxp pro sp2 / apache box?

[DanceInstructor]

Why not try the windows firewall while you search for another....