Q I run a hosting service with over 100 domains configured on it. Our server seems to have been sluggish for the last few days. I did some preliminary tests (using netstat) and noticed that there were a lot of connections from my server on TCP port 80 to my server on the ephemeral ports. From the output that I got I understand that I have connections originating from Apache on port 80 to the various other ports on my server. But why? How can my server be browsing my own websites? I run Apache 2 on Red Hat Enterprise Linux 3.
A This certainly sounds like one of your more recent websites is responsible for this new behaviour. From the netstat feedback that you describe, I would say that some of the respective code is triggering connections to your web server. By analysing what your Apache server is doing, we can compare the number of netstat connections with what Apache is serving out. Enable this by placing the following in the Apache configuration file (/etc/httpd/conf/httpd.conf):
ExtendedStatus on <Location /server-status> SetHandler server-status </Location>
If you browse to www.domain.com/server-status?refresh=5, you will get a five-second update of your server's status. Pay particular attention to CPU usage (CPU) and the number of seconds since the beginning of the most recent request (SS). Also, by correlating the number of connections from the netstat output with the number of connections on a particular virtual host, you will quickly find the culprit!