3

We just had to restart the coldfusion server as it had become unresponsive. Looking at the Apache error log (We have jrun 4 through Apache on a RedHat server), I see the following over and over...

[Tue Jun 02 12:21:45 2009] [info] server seems busy, (you may need to increase StartServers, or Min/MaxSpareServers), spawning 8 children, there are 2 idle, and 59 total children [Tue Jun 02 12:21:45 2009] [notice] jrApache[11773: 62983] initialized proxy for 127.0.0.1:51010 [Tue Jun 02 12:21:45 2009] [notice] jrApache[11780: 47108] initialized proxy for 127.0.0.1:51010 [Tue Jun 02 12:21:47 2009] [notice] jrApache[11784: 37263] initialized proxy for 127.0.0.1:51010 [Tue Jun 02 12:21:47 2009] [notice] jrApache[11786: 774] initialized proxy for 127.0.0.1:51010 [Tue Jun 02 12:21:47 2009] [notice] jrApache[11787: 63825] initialized proxy for 127.0.0.1:51010 [Tue Jun 02 12:21:47 2009] [notice] jrApache[11788: 45712] initialized proxy for 127.0.0.1:51010 [Tue Jun 02 12:21:47 2009] [notice] jrApache[11789: 1286] initialized proxy for 127.0.0.1:51010 [Tue Jun 02 12:21:53 2009] [notice] jrApache[11815: 8710] initialized proxy for 127.0.0.1:51010

This happens again and again, so I assume whatever is causing it is spawing these extra children until the server runs out of memory and stops responding.

What I can't work out is why this is happening. Is anyone familiar with jrun and might know what's going on?

nedlud
  • 273
  • 2
  • 10

2 Answers2

1

Is this a public website or an interanet/extranet site?

Has the problem been going on for a while or just sudenly start?

What version of ColdFusion are you using?

Assuming this is a public website I'd recommend looking at your access logs or look at mod_status (ExtendedInfo enabled) to see what URLs are being requested. Its possible you have an attack or even just heavy (unexpected traffic).

If you do have abnormal traffic, see if you can also figure out where the traffic is coming from. Maybe digg or slashdot got a hold of you? :-)

KPWINC
  • 11,274
  • 3
  • 36
  • 44
  • We have both a public internet site and our intranet site on the one server. The machine crashes regularly, but in the absence of anyone else looking into why, I've decided to try and work out what the problem is by myself. We are using CF6. But I also suspect some attack ATM which surely isn't helping things. I'll look at the access logs and see if I can glean some information from them. – nedlud Jun 03 '09 at 10:20
0

Check your access logs to see what URLs are being requested, is the amount of traffic normal? What you would expect? Perhaps it's an attack.

What are your StartServers, Min/MaxSpareServers settings in http.conf?

domoaringatoo
  • 176
  • 6