[SlugBug] Apache memory usage problem

[Chris J]

And Lo! The Great Prophet Bill Best uttered these words of wisdom:
> hi
> 
> my installation of Apache has recently started to lock up and cause the 
> following problem:
> 
> > Dec  5 16:18:25 xxxx kernel: Out of Memory: Killed process 30482 (httpd).
> > Dec  5 16:19:18 xxxx kernel: Out of Memory: Killed process 29956 (httpd). 

Doesn't look good ...

> 
> there is an Apache memory usage problem - here's top:

> >   PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
>  5942 apache    15   0  312m 252m  17m S  0.0 12.4   0:30.97 httpd
> >  3518 apache    15   0  468m 164m  17m S  0.0  8.1   1:08.03 httpd
> >  3524 apache    15   0  406m 132m  17m S  0.0  6.5   1:12.67 httpd


*snippage*

I'm intruiged to see Apache eating getting on for half a gig of RAM. It 
does seem a tad excessive. What version of Apache are you running and is 
this on an internet-facing box? See here:

	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2970

which is apparently fixed in Apache 2.0.55 (this also lists broken versions 
of apache):

	http://httpd.apache.org/security/vulnerabilities_20.html


> any clues as to what might be going wrong?
> 
> this reference here points to a "bad rewrite rule":
> 
> http://kimihia.org.nz/articles/apachemem/

I quick google myself doesn't throw up anything more than what you've found 
so I'm not too sure. I'd just double-check your rules aren't too complex 
and leave it at that. You've not got a lot of rewrite rules have you?

I've found other references to the PHP-5 module which was leaking memory:

http://groups.google.co.uk/group/mailing.www.php-dev/browse_thread/thread/49694efa43f934db/37581a4720eca8b4?lnk=st&q=apache+memory+leak&rnum=1#37581a4720eca8b4

> 
> my questions are:
> 
> i) is the above good advice?

Unanswerable without more information

> ii) why doesn't/cannot apache release the memory it uses?

I don't think its apache, I think it's possibly a module behaving badly and 
not free()'ing what it's malloc()'d.

> iii) how might i best identify which rewrite rule is bad?

Comment them all out, then comment each rule back in, one by one.

> iv) any other advice?

Remove all your modules(!) and then start putting them back in one-by-one 
and find out when it starts misbehaving.

What I don't see here is if you've made any changes to configuration or 
code (upgraded modules? upgraded apache? upgraded anything on your box at 
all?), nor do I see version info, so it's a bit tricky to suggest anything 
else.

Cheers,

Chris...


-- 
\ Chris Johnson                 \ NP: KAJIURA Yuki - HIMITSU
 \ cej at nightwolf.org.uk          \  
  \ http://cej.nightwolf.org.uk/  \ 
   \ http://redclaw.org.uk/        ~---------------------------------------