Apache is starting to be very slow :(

[JonathanNet]

Hi

I noticed today that my apache2 is very slow to load sites, and it uses alow of cpu, hope any one can help me with this to get it fixed, and I didnt change anything, this is what I get from the error.log in /var/log/apache2

Using:

PHP 5.5.9-1ubuntu4.14 (cli) (built: Oct 28 2015 01:34:46)
Copyright © 1997-2014 The PHP Group
Zend Engine v2.5.0, Copyright © 1998-2014 Zend Technologies
with Zend OPcache v7.0.3, Copyright © 1999-2014, by Zend Technologies

Server version: Apache/2.4.7 (Ubuntu)
Server built: Oct 14 2015 14:20:21

Code:

[Tue May 03 17:07:46.170332 2016] [core:notice] [pid 15829] AH00051: child pid 19335 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170426 2016] [core:notice] [pid 15829] AH00051: child pid 18797 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170452 2016] [core:notice] [pid 15829] AH00051: child pid 18798 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170476 2016] [core:notice] [pid 15829] AH00051: child pid 17030 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170501 2016] [core:notice] [pid 15829] AH00051: child pid 19337 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170539 2016] [core:notice] [pid 15829] AH00051: child pid 17991 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170562 2016] [core:notice] [pid 15829] AH00051: child pid 19346 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170586 2016] [core:notice] [pid 15829] AH00051: child pid 19349 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170609 2016] [core:notice] [pid 15829] AH00051: child pid 19356 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170632 2016] [core:notice] [pid 15829] AH00051: child pid 19358 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170657 2016] [core:notice] [pid 15829] AH00051: child pid 18806 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170682 2016] [core:notice] [pid 15829] AH00051: child pid 18808 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170721 2016] [core:notice] [pid 15829] AH00051: child pid 16419 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170745 2016] [core:notice] [pid 15829] AH00051: child pid 18008 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170768 2016] [core:notice] [pid 15829] AH00051: child pid 18815 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170828 2016] [core:notice] [pid 15829] AH00051: child pid 18821 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170854 2016] [core:notice] [pid 15829] AH00051: child pid 18831 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170877 2016] [core:notice] [pid 15829] AH00051: child pid 18840 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170929 2016] [core:notice] [pid 15829] AH00051: child pid 16495 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.170952 2016] [core:notice] [pid 15829] AH00051: child pid 18854 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.171011 2016] [core:notice] [pid 15829] AH00051: child pid 18860 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.171054 2016] [core:notice] [pid 15829] AH00051: child pid 18861 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.171097 2016] [core:notice] [pid 15829] AH00051: child pid 18079 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.171123 2016] [core:notice] [pid 15829] AH00051: child pid 18862 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.171146 2016] [core:notice] [pid 15829] AH00051: child pid 18872 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:46.171169 2016] [core:notice] [pid 15829] AH00051: child pid 16545 exit signal Segmentation fault (11), possible coredump in /etc/apache2
[Tue May 03 17:07:47.172460 2016] [mpm_prefork:notice] [pid 15829] AH00169: caught SIGTERM, shutting down
[Tue May 03 18:38:15.698459 2016] [ssl:warn] [pid 23841] AH02292: Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
[Tue May 03 18:38:15.750243 2016] [:notice] [pid 23842] mod_bw : Memory Allocated 0 bytes (each conf takes 48 bytes)
[Tue May 03 18:38:15.750295 2016] [:notice] [pid 23842] mod_bw : Version 0.92 - Initialized [0 Confs]
PHP Warning:  Module 'mysqlnd' already loaded in Unknown on line 0
[Tue May 03 18:38:15.819139 2016] [ssl:warn] [pid 23842] AH02292: Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
[Tue May 03 18:38:15.831695 2016] [mpm_prefork:notice] [pid 23842] AH00163: Apache/2.4.7 (Ubuntu) OpenSSL/1.0.1f configured -- resuming normal operations
[Tue May 03 18:38:15.831782 2016] [core:notice] [pid 23842] AH00094: Command line: '/usr/sbin/apache2'
[Tue May 03 18:41:36.876097 2016] [mpm_prefork:error] [pid 23842] AH00161: server reached MaxRequestWorkers setting, consider raising the MaxRequestWorkers setting

[Me.B]

Is this a cutom apache? I don't see suhosin in php signature here...

I think you can tune: MaxRequestWorkers in apache config file.

But before do you have enough ram? Did you identify the website/ Process that use so much cpu? (use logs).

M B

[JonathanNet]

No its not a custom apache, its installed with the sentora install script and I think suhosin is enabled in it.

But I found out it was a DDOS, on my webserver, but I got the ips blocked in the firewall now, and all works normal again but thx for help anyways.