Topic: Apache cpu 100% - need help.

[buttlerkid]

I'm running a website, but i'm not having so many visitors, around 300-400/day. I have Comodo FIrewall installed and at apache's connections it shows me about 100 different ip addresses. Those are using the cpu.

Is somebody flooding me ?(which i doubt)

I am searching the net to find an answer, but i found nothing.

Hope somebody can figure it out .
Thank you

[James Blond]

How is this 64 bit related? Doesn't your firewall block the ip's is there are too many requests? if you open the taskmanger which has the usage? The firewall or apache?

[buttlerkid]

The apache is having the biggest usage. I mean he's the only one having that big usage.

[James Blond]

[buttlerkid]

Well let me explain how it started.
I was having my apache running on vista x64. There were no problems, but then, just from out of nowhere, the cpu usage got to 100 %.
I thought it was from vista. I installed windows 7 x64, but it was the same issue. I formatted all of my hard disk, reinstalled windows 7 of course and installed Comodo firewall too, but the problem continued.
I've changed my ip address and my subdomain to another(i have a domain and one of it's subdomains runs on my pc), the same problem.
I keep getting couple of thousand different ip addresses connecting and if I block them, new ones appear.
Tried to search the net, i found about bots, i came across over my issue on a forum, but it wasn't solved.
I tried on CentOS 5.5 too, but i need a certain apache,php and eaccelerator version for my website to run.
I keep searching each day, but i cannot find a solution to my problem.
I didn't had this issue before. I had an average 700.000 page views per day, apache was only using 20-30% of the cpu. I have a good internet and a great pc, i don't know why apache is creating me such a big problem.
I tried to use some configuration for httpd/conf which i came across on the net, but it didn't help.

That's all. Thanks for reading it and thanks for trying to help.

[buttlerkid]

Any ideas?

[James Blond]

Did you already analysed your log files? Is there a specific url the bots request?
Countermeasures: Do you have a router or firewall before your server or is it directly on the internet? Blocking the IPs (requests) before they reach the server is mostly a good option.

[buttlerkid]

Mod note: Moved all the log stuff to http://pastebin.com/3BnkswzT. Please never spam the forum with such long log files.

[buttlerkid]

What could this possibly be ? DDOs?

[James Blond]

The stuff you posted is normal activity. Nothing to see from a DOS attack. How many requests does your server handles per second? What kind of hardware do you use? Maybe it is on its limit.