Apache server stopped recording accesses in the access.log file

1

I'm running a DDoS attack experiment on a virtual apache server (VMWare). The attack went to the apache service and not to the machine.

From a certain time (10.20), although there were machines making requests to Apache, the access.log file did not register anymore. The last log record was error 408 (because of the attack).

The apache service did not stop (I checked). Any idea what happened? The virtual server was running Debian in text mode.

Please note that logging stopped between 10h20-11h20

    
asked by anonymous 07.04.2017 / 19:19

1 answer

2

Always remember to check http codes in cats :

Basically,youmadesomuchexecutiontotheapachethatsomepartsofitsaid"goodbye, cruel life". One of these parts was the logger / appender, which did not support the excess of requests; Apache was so crowded that it could not even respond in a timely manner to a request, he envisioned the result of all these repetitions.

I've been looking here as apache handles the requests. I thought that for each request it would open a new thread, but I did not find a quick search something confirming my suspicions ... However, I found an English reference on the life cycle of an HTTP request in apache . Maybe it's worth a read.

EDIT

I found some reference to apache and threads in a International StackOverflow quest . Basically, every request that apache can handle will create a new program context to serve it. This can generate a processing bottleneck (each processing core can only serve a single context in that sense) as well as a bottleneck in memory (each context requires a bit of memory to run; need 1KB to run, then 1 million requests will create 1 million different contexts, so in this scenario, it would need at least 1GB of initial context information only; EMPHASIS: THIS IS AN EXAMPLE WITH INVENTED DATA WITHOUT BASED ON REALITY, USED ONLY TO EXPLAIN THE WEIGHT OF THOSE MANY THREADS ).

To avoid this kind of vulnerability, node.js (a purely JavaScript server) uses a limited number of threads to requisitions, usually just one.

In conclusion, it would be nice to have a graph analyzing server performance by showing how much CPU and memory is being used.

    
07.04.2017 / 20:23