Topic: Segmentation fault caused by flooding???

[madadam]

I am having a bit of troubles with an irregular problem that brings down some parts of my websites probably initiated by bots flooding a site.

The interesting thing is not all websites go down, only some with the same domain but different subdomains, but not all. For example www.domain1.com and test.domain1.com may go down while chat.domain1.com remain up and other domains like www.domain2.com remain up. The same ones always go down (then again the attack is always on the same domain web page).

What seems to be happening is that after a concerted flood (approx 50-200 POSTs over 5-20 seconds) on a web page containing an email form (now protected with a CAPTCHA image) the site seems to crash.

Around the same time in the httpd/error_log I will first see a number of the following messages:

[{int}] EACCELERATOR: PHP crashed on OPLINE 31 of {filename}

Followed by a number of these messages:

[{TIME}] [notice] child pid {int} exit signal Segmentation fault (11)

There are no other clues in other log files (that I've found).

From this point forward the websites I mentioned above don't work - the browser says the server unexpectedly dropped the connection. A simple "service httpd-e-smith restart" will fix the problem.

Does anyone have any suggestions that might shed some light on this problem.

Cheers!

adam

[CharlieBrady]

Followed by a number of these messages:

[{TIME}] [notice] child pid {int} exit signal Segmentation fault (11)
...
Does anyone have any suggestions that might shed some light on this problem.

Segmentation fault always indicates either a hardware problem or a program bug. I suspect yours in in php or the php accelerator you are using.

[madadam]

Thanks Charlie.

I was thinking along the same times but discounted a hardware fault (ie. memory) due to the fact that it only seems to happen after a concerted spam attach by a bot. Memory failure would should up a more random problem.

I suspect it's a problem with EACCELERATOR but can't figure out why it's only happening when there is an attack from a spam-bot. It would seem it has something to do with the number of POSTs in a second - but that may be misleading. I haven't been able to replicate the problem manually by writing a bit of code to do the same thing locally so I am waiting for it to happen again then I will do some more detective work.

Adam

[piran]

Adam----
ClamAV used to have some issues that resulted in segmentation
faults for particular types of email transactions. Haven't seen
such here for a long time so have assumed they've been dealt
with but you might consider that area as a possible vector.
On a similar vein there is a way to limit the transaction rate
too but I forget whether this is/was a SME thing or AV thing.
If you're familar with what BadBot does then that'll almost
certainly do the trick depending on what you've got running
(WP/CMS). Hope you isolate the issue as it's in all our very
best interests... whatever they get away with on your site
will be inflicted on the rest of us soon enough;~/
----best wishes, Robert

[CharlieBrady]

ClamAV used to have some issues that resulted in segmentation
faults for particular types of email transactions.

Unless there is some extension that I'm not aware of, ClamAV does not ever run in the address space of apache, so cannot cause a segfault in apache.

[piran]

[PostEdit: I'm talking rubbish just ignore it]

[CharlieBrady]

The Clam people recognised the issue, ran with it, then fixed a while later...

I don't doubt it. A bug in clamav could certainly crash clamav, and be tickled by a particular email message. But the same bug wouldn't crash apache, or php.

[piran]

Charlie----
Forget I mentioned it please and I'll forget I saw SEGMENTATION FAULT.
----best wishes, Robert