On 6/30/2011 4:53 PM, Robert Heller wrote: > >> Right now it doesn't look like an mail run, more like a httpd run >> because it's starting to look like a large number of httpd threads was >> spawned just before that. > OK, there are probably settings for Apache to run fewer threads. > Probably better have a "Server too busy" type of message than a wedged > server. (And most likely the extra httpd threads will just be spambots > of some sort anyway -- who cares if they get tossed...) > With the launch of Living Social, we have had a few clients use that service and you will suddenly have all Apache instances running and the server acting very laggy to all but unresponsive. I have cut back on the total number of Apache instances due to these 'non-attacks' which are much like a DoS attack. It seems the first day is horrid, the second not so bad and it wains down from there. This really raises a new question of what to do the handle such broadcast ads? We run very conservative server loads, but... I don't recommend running it all the time, only when you need to catch something, but server status can be your friend. You can run a refresh in your browser... leave it running in a tab set to refresh like once every minute or five. It will show the instances of Apache and the files being accessed. Much faster than digging through logs in a Virt server environment. This feature is built into Apache, but is not on by default. Look at your httpd.conf file. -- John Hinton 877-777-1407 ext 502 http://www.ew3d.com Comprehensive Online Solutions