0

I have a Web application built in PHP. The client is a standard html/js page viewed in the web browser. This client sends Ajax requests every minute to get its updates. This setup worked the same way since two years.

The logs tell me that one user seems not to have shut down his computer on Thursday, so the browser client was sending his requests over the Easter weekend without pause. This normally should be no problem, it is just the only odd thing I noticed trying to trace the problem. Around 4PM on Sunday the requests by this client as found in Apaches access.log abruptly stopped.

Around 6PM suddenly the app is not reachable anymore, as the maximum number of connections of Apache is reached. More than 400 connections by the IP of said client are in the state of CLOSE_WAIT.

I am now trying to understand how this could happen. There is no external database and only PHP on Apache2 used. Normally the handling of the tcp request should therefore not be an occuring problem, as they're out of the scope of the PHP application.

Thank you.

dboth
  • 97
  • 1
  • 9
  • You might want to consider looking in to the `Connection: keep-alive` header, which will instruct browsers to use the same connection for each request (so you won't get so many open connections from each client that get stuck in the half-open state if the client doesn't respond to the request to close the connections. – Chris Mar 27 '16 at 17:57
  • @Chris `KeepAlive` is set to on in the Apache config, with a `KeepAliveTimeout` of 5 seconds. – dboth Mar 27 '16 at 18:20
  • CLOSE_WAIT is the state the socket is in when the peer (i.e. ~ the computer running the browser in this case) has closed the connection and the FIN packet has been received by your server but the local application (your httpd) hasn't also closed the connection. This is probably a question more suited for [serverfault.com](http://serverfault.com/). But: How is php "integrated" into the httpd (apache module, fcgi, ....)? Does the php script communicate with a database et al? If so, is there something weird about _that_ process, too? Which versions of httpd, php, .... do you use? – VolkerK Mar 27 '16 at 18:30
  • @VolkerK It's Apache 2.2.22 on Debian 7. PHP 5.4.45 is integrated as an Apache module. There is a MySQL 5.5.47 database on the localhost that is used by the application, but there are no errors found in the log. – dboth Mar 27 '16 at 18:43
  • @VolkerK I could be wrong (I'm not an expert on networking issues) but in this case isn't it the server that has attempted to close the connection and the client that hasn't responded to the `FIN` packet sent by the server? I concur that the people over at Server Fault would probably be best to answer the question though. – Chris Mar 27 '16 at 19:30
  • I'm not an expert either but take a look at https://en.wikipedia.org/wiki/Transmission_Control_Protocol#Connection_termination . If the server shows CLOSE_WAIT the server is the "Receiver" and it hasn't (yet) send the ACK+FIN package, which it will do once the application (on the receiver/server) also calls close(). It's also the (only) scenario that makes sense given the amount of time the sockets (on the server) stay in the CLOSE_WAIT status. If it was the other way round and there was no (rather short) timeout, anybody could easily "kill" any server. – VolkerK Mar 27 '16 at 19:39

0 Answers0