httpd was shutdown

[kaancho12]

hi,
today i was checking the server and it got shutdown for some reason. when i checked the httpd error log there wasnt any information regarding who/what shut it down and i am puzzled by the fedora server log which doesnt have any information regarding why it was shutdown. when i checked the stuatus of the server it said "httpd dead but pid file exists" before i restarted it. is there a log somewhere of why it does so?
btw i am on Fedora Core 3.
thanks
ko12

 

[thedaver]

The pid file exists because the httpd daemons did not terminate normally. It is possible that someone ran enough simultaneous bogus http requests at your box that it crashed all of the httpd daemons at roughly the same time.

Normally Apache keeps one daemon around to spawn children so if you're using Apache this shouldn't happen. However, I suppose it's possible.

You might also have RAM problems, disk problems, permission problems, etc....

However, the existence of a pid file indicates a fatal crash or innapropriate shutdown....


OR, your box was power cycled without letting the linux init system clean up beforehand.... this might also explain the pid file

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[RhythmAce]

Dang you just about covered everything. I vote for power failure.

 

[kaancho12]

thanks for your post guys,
i have another question. i ran "nmap -sT -O localhost" on the machine and it gave me this result:
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
80/tcp open http
110/tcp open pop3
143/tcp open imap
443/tcp open https
9999/tcp open abyss

i guess everything looks fine except i see that port 9999 is open to "abyss". upon looking at the "abyss" it seems to be some kind of webserver which i am not sure is being used at all. Do u think i should shut it off or is there some special program which might be using it. i am using postfix for the mail program, other ports that are open are also being used. thanks
ko12

 

[RhythmAce]

If you are using a firewall, it will close all ports except those you specify.

 

[thedaver]

We don't know what you've installed and are running, therefore we cannot advise you.

That said, if you did not install it, you did not start it, you don't know why it's running and you have already had a suspicious event, you need to begin considering a hack.

Looking at some posts over the last two years, abyss seems like it has some security problems....

Rule #1 in a suspected hack/breakin is to get your machine off of the network.

Check your logs carefully!!!!

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/