On 6/30/2011 4:53 PM, Robert Heller wrote:
Right now it doesn't look like an mail run, more like a httpd run because it's starting to look like a large number of httpd threads was spawned just before that.
OK, there are probably settings for Apache to run fewer threads. Probably better have a "Server too busy" type of message than a wedged server. (And most likely the extra httpd threads will just be spambots of some sort anyway -- who cares if they get tossed...)
With the launch of Living Social, we have had a few clients use that service and you will suddenly have all Apache instances running and the server acting very laggy to all but unresponsive. I have cut back on the total number of Apache instances due to these 'non-attacks' which are much like a DoS attack. It seems the first day is horrid, the second not so bad and it wains down from there.
This really raises a new question of what to do the handle such broadcast ads? We run very conservative server loads, but...
I don't recommend running it all the time, only when you need to catch something, but server status can be your friend. You can run a refresh in your browser... leave it running in a tab set to refresh like once every minute or five. It will show the instances of Apache and the files being accessed. Much faster than digging through logs in a Virt server environment. This feature is built into Apache, but is not on by default. Look at your httpd.conf file.