Hola
A raiz de un funcionamiento anormal con mi servidor web apache, que tiene un sistema escrito en PHP, me puse a revisar los logs del apache y encontrado registros extraños.
Lo que sucede es que apenas levanto el servidor se llena de hilos el apache, esto lo veo con un (pstree -up, teniendo hasta mas de 100 hilos) y supongo que eso hace que el servidor responda cada vez más lento, hasta que finalmente deja de responder, es como un ataque de DoS pero no estoy seguro, a continuacion opngo algunas lineas que son extrañas en los logs del sistema, ojala puedan ayudarme a resolver el problema
access.log:
122.145.216.104 - - [27/Mar/2008:11:58:28 -0600] "\x04\x01" 200 494 "-" "-"
209.11.245.211 - - [27/Mar/2008:11:58:02 -0600] "CONNECT 209.11.245.211:25 HTTP/1.0" 200 494 "-" "-"
88.208.218.68 - - [27/Mar/2008:11:53:16 -0600] "CONNECT 88.208.218.70:25 HTTP/1.0" 200 494 "-" "-"
89.42.48.2 - - [27/Mar/2008:11:53:16 -0600] "CONNECT smtp.gmail.com:587 HTTP/1.0" 200 494 "-" "-"
72.55.165.152 - - [27/Mar/2008:11:50:22 -0600] "GET
http://www.myspace.com/ HTTP/1.0" 200 494 "-" "Mozilla/5.0 (Windows; en-US;)"
error.log
[Thu Mar 27 11:07:53 2008] [error] [client 74.86.82.226] File does not exist: /var/www/upload
y la salida del comando: netstat -an | grep :80 | sort
tcp6 0 0 :::80 :::* ESCUCHAR
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.206:1606 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.206:3589 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.206:4052 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.207:2680 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:1184 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:1310 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:1331 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:1350 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:1422 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:1430 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:1584 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:1612 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:1865 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:2397 ESTABLECIDO
tcp6 0 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:2456 ESTABLECIDO
un poco mas
tcp6 3 0 ::ffff:192.168.1.201:80 ::ffff:220.150.99.:2086 ESTABLECIDO
tcp6 3 0 ::ffff:192.168.1.201:80 ::ffff:220.150.99.:3956 ESTABLECIDO
tcp6 3 0 ::ffff:192.168.1.201:80 ::ffff:220.150.99.:4849 ESTABLECIDO
tcp6 334 0 ::ffff:192.168.1.201:80 ::ffff:74.86.82.22:1871 CLOSE_WAIT
tcp6 405 0 ::ffff:192.168.1.201:80 ::ffff:189.133.122:2532 ESTABLECIDO
tcp6 4 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:3117 CLOSE_WAIT
tcp6 4 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:4000 CLOSE_WAIT
tcp6 4 0 ::ffff:192.168.1.201:80 ::ffff:220.150.102:2045 CLOSE_WAIT
tcp6 4 0 ::ffff:192.168.1.201:80 ::ffff:220.150.38.:1277 CLOSE_WAIT
tcp6 661 0 ::ffff:192.168.1.201:80 ::ffff:189.141.24:51841 ESTABLECIDO
tcp6 9 0 ::ffff:192.168.1.201:80 ::ffff:122.145.206:3286 ESTABLECIDO
tcp6 9 0 ::ffff:192.168.1.201:80 ::ffff:122.145.206:3810 ESTABLECIDO
tcp6 9 0 ::ffff:192.168.1.201:80 ::ffff:122.145.206:3892 ESTABLECIDO
tcp6 9 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:1055 ESTABLECIDO
tcp6 9 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:1068 ESTABLECIDO
tcp6 9 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:1539 ESTABLECIDO
tcp6 9 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:2281 ESTABLECIDO
tcp6 9 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:2724 ESTABLECIDO
tcp6 9 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:2758 ESTABLECIDO
tcp6 9 0 ::ffff:192.168.1.201:80 ::ffff:122.145.212:3102 ESTABLECIDO
Por favor cualquier aportacion será de mucha ayuda
Saludos