[ILUG] Apache gobbling CPU

[Justin Mason]

Niall O Broin writes:
> I just encountered an odd situation on a webserver where the load had  
> become rather high, and top was showing me two apache processes each  
> consuming > 45% of CPU. Running strace on one of the processes I saw  
> that it was doing the below (and nothing else, or nothing else strace- 
> able) in a loop:
> 
> open("/etc/hosts", O_RDONLY)            = 55
> fcntl64(55, F_GETFD)                    = 0
> fcntl64(55, F_SETFD, FD_CLOEXEC)        = 0
> fstat64(55, {st_mode=S_IFREG|0644, st_size=300, ...}) = 0
> mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,  
> 0) = 0xb6477000
> read(55, "127.0.0.1    localhost       loc"..., 4096) = 300
> read(55, "", 4096)                      = 0
> close(55)                               = 0
> munmap(0xb6477000, 4096)                = 0
> 
> So, I killed it whereupon the CPU usage of its partner in crime jumped  
> to over 90% and strace revealed it to be engaged in the same  
> behaviour, which got it the same treatment, and load is back down to a  
> sensible figure.
> 
> In all likelihood, this was caused by some piece of PHP gone mad but  
> the question is, what, and how to find out? Given such a situation, is  
> there any way of mapping a particular apache process to a request?

mod_status is your friend!

--j.