Мой Apache с ModSecurity, включен mod_evasive20 иногда происходит сбой:
Это проблеск журнала ошибок:
[core:warn]**: child process 24709 still did not exit, sending a SIGTERM
[core:error]**: child process 24709 still did not exit, sending a SIGKILL
[mpm_event:notice] **: caught SIGTERM, shutting down
В прошлый раз произошел сбой Apache A, когда Google Analytics сообщил о 2К + просмотрах в реальном времени. Я вижу, что слишком много дочерних процессов также может быть результатом атаки типа DDoS. Но я хочу убедиться, что это действительно атака или ошибка конфигурации.
Пожалуйста помоги.
Машина: Ubuntu 18.04, 16 ГБ ОЗУ, 8-ядерный ЦП, 180 ГБ SSD
Конфигурация события MPM:
<IfModule mpm_event_module>
StartServers 2
MinSpareThreads 25
MaxSpareThreads 150
ThreadLimit 250
ThreadsPerChild 250
MaxRequestWorkers 6250
ServerLimit 25
MaxConnectionsPerChild 0
</IfModule>
Подробный журнал ошибок:
[Thu Mar 19 06:25:02.506142 2020] [mpm_event:notice] [pid 1460:tid 139655311739840] AH00489: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.0g Apache configured -- resuming normal operations
[Thu Mar 19 06:25:02.506172 2020] [core:notice] [pid 1460:tid 139655311739840] AH00094: Command line: '/usr/sbin/apache2'
[Thu Mar 19 09:15:42.817591 2020] [core:warn] [pid 1460:tid 139655311739840] AH00045: child process 24709 still did not exit, sending a SIGTERM
[Thu Mar 19 09:15:44.819958 2020] [core:warn] [pid 1460:tid 139655311739840] AH00045: child process 24709 still did not exit, sending a SIGTERM
[Thu Mar 19 09:15:46.822259 2020] [core:warn] [pid 1460:tid 139655311739840] AH00045: child process 24709 still did not exit, sending a SIGTERM
[Thu Mar 19 09:15:48.824514 2020] [core:error] [pid 1460:tid 139655311739840] AH00046: child process 24709 still did not exit, sending a SIGKILL
[Thu Mar 19 09:15:49.826497 2020] [mpm_event:notice] [pid 1460:tid 139655311739840] AH00491: caught SIGTERM, shutting down
[Thu Mar 19 09:15:49.962067 2020] [:notice] [pid 29976:tid 140194146679744] ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/) configured.
[Thu Mar 19 09:15:49.962131 2020] [:notice] [pid 29976:tid 140194146679744] ModSecurity: APR compiled version="1.6.2"; loaded version="1.6.3"
[Thu Mar 19 09:15:49.962136 2020] [:warn] [pid 29976:tid 140194146679744] ModSecurity: Loaded APR do not match with compiled!
[Thu Mar 19 09:15:49.962140 2020] [:notice] [pid 29976:tid 140194146679744] ModSecurity: PCRE compiled version="8.39 "; loaded version="8.39 2016-06-14"
[Thu Mar 19 09:15:49.962144 2020] [:notice] [pid 29976:tid 140194146679744] ModSecurity: LUA compiled version="Lua 5.1"
[Thu Mar 19 09:15:49.962147 2020] [:notice] [pid 29976:tid 140194146679744] ModSecurity: YAJL compiled version="2.1.0"
[Thu Mar 19 09:15:49.962150 2020] [:notice] [pid 29976:tid 140194146679744] ModSecurity: LIBXML compiled version="2.9.4"
[Thu Mar 19 09:15:49.962154 2020] [:notice] [pid 29976:tid 140194146679744] ModSecurity: Original server signature: Apache/2.4.29 (Ubuntu)
[Thu Mar 19 09:15:49.962157 2020] [:notice] [pid 29976:tid 140194146679744] ModSecurity: Status engine is currently disabled, enable it by set SecStatusEngine to On.
[Thu Mar 19 09:15:50.025004 2020] [mpm_event:notice] [pid 29986:tid 140194146679744] AH00489: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.0g Apache configured -- resuming normal operations
[Thu Mar 19 09:15:50.025066 2020] [core:notice] [pid 29986:tid 140194146679744] AH00094: Command line: '/usr/sbin/apache2'
Если потребуется дополнительная информация, укажите. Спасибо.