1

I've got a LAMP setup running and I seem to have many CLOSE_WAIT connections for apache2 program when I netstat (several hundred). This eventually causes my apache to become unresponsive.

Bellow is the setup:

php: 

PHP 5.3.10-1ubuntu3.6 with Suhosin-Patch (cli) (built: Mar 11 2013 14:31:48) 
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies

apache2:

Server version: Apache/2.2.22 (Ubuntu) [running mpm-prefork]

mysql

Server version: 5.5.29-0ubuntu0.12.04.2-log (Ubuntu)

Running Ubuntu 12.04 LTS

Linux numerink201 3.2.0-34-virtual #53-Ubuntu SMP Thu Nov 15 11:08:40 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

I have a couple of questions:

  1. How can I know in what point of the process I am? Obviously the client sent a FIN/RST request, but how would I know which, and if FIN how do I know if if the process has sent it's own FIN/ACK or if I'm waiting on the client ACK. Or if all was received but the process failed to close?

  2. If it's apache failing to properly close the process how can I locate the issue?

I've currently reduce TimeOut for apache from 300s to 150s as a temporary measure. Would there be a better way of going about it?

Thanks in advance.

D.Mill
  • 379
  • 5
  • 15

1 Answers1

0

It might be helpful if you provided your kernel version and told us which MPM you're using. If it's the worker (threads) server, then switch to pre-fork (not because Rasmus said it was a bad idea in 2005 - there are issues in Apache too).

many CLOSE_WAIT connections

For which server? httpd? MySQL? Something else?

Obviously the client sent a FIN request

Last time I looked at this in any detail, both MSIE and Firefox usually close connections with a RST not a 'clean' shutdown.

You're presumably not concerned with performance hence disabling keepalives may help as a temporary reprieve.

symcbean
  • 21,009
  • 1
  • 31
  • 52
  • Thanks a lot for your response. I've edited my question, the main points are: CLOSE_WAIT connections are for apache2 (httpd). The requests that hang until they timeout all come from the same IP I got ahead of myself with the FIN comment it could very well be a RST. How can I check? Thanks again – D.Mill Apr 26 '13 at 12:58
  • That they "all come from the same IP" might be the answer here - unless you know you trust the user there, block their subnet now. – symcbean Apr 26 '13 at 13:57