Keywords: General - AWS - Technical issue - Other
Description:
I have a site with very little traffic hosted on AWS Ligthsail for around 2 years. It worked pretty well until recently it is down for a few times. I have to reboot the server to recover it. But after a few hours it is down again so I have reboot it again.
When I checked the log file I found there are a lot errors as the following in the /opt/bitnami/apache2/logs/error_log
[Sun Jan 31 02:08:40.762173 2021] [proxy_fcgi:error] [pid 6570:tid 139928482440960] (70007)The timeout specified has expired: [client 162.158.165.149:56152] AH01075: Error dispatching request to : (polling)
[Sun Jan 31 02:09:09.522597 2021] [proxy_fcgi:error] [pid 6570:tid 139928925964032] (70007)The timeout specified has expired: [client 172.69.134.178:32252] AH01075: Error dispatching request to : (polling)
[Sun Jan 31 02:09:40.783398 2021] [proxy_fcgi:error] [pid 6570:tid 139928398513920] (70007)The timeout specified has expired: [client 162.158.165.23:52752] AH01075: Error dispatching request to : (polling)
[Sun Jan 31 02:10:08.386622 2021] [proxy_fcgi:error] [pid 6570:tid 139928390121216] (70007)The timeout specified has expired: [client 172.69.134.112:41172] AH01075: Error dispatching request to : (polling)
[Sun Jan 31 02:10:32.002887 2021] [proxy_fcgi:error] [pid 6570:tid 139928574760704] (70007)The timeout specified has expired: [client 108.162.237.57:51154] AH01075: Error dispatching request to : (polling)
[Sun Jan 31 02:10:39.382545 2021] [proxy_fcgi:error] [pid 6570:tid 139928557975296] (70007)The timeout specified has expired: [client 162.158.166.238:17712] AH01075: Error dispatching request to : (polling)
[Sun Jan 31 02:11:09.674597 2021] [proxy_fcgi:error] [pid 6570:tid 139928440477440] (70007)The timeout specified has expired: [client 162.158.167.63:53314] AH01075: Error dispatching request to : (polling)
[Sun Jan 31 02:11:35.986611 2021] [proxy_fcgi:error] [pid 6570:tid 139928541189888] (70007)The timeout specified has expired: [client 172.69.170.127:52568] AH01075: Error dispatching request to : (polling), referer: https://xxxxxxxxx.com
[Sun Jan 31 02:11:40.693157 2021] [proxy_fcgi:error] [pid 4087:tid 139928951142144] (70007)The timeout specified has expired: [client 172.68.146.189:24666] AH01075: Error dispatching request to : (polling)
[Sun Jan 31 03:03:21.958415 2021] [mpm_event:error] [pid 4077:tid 139929162622720] AH10159: server is within MinSpareThreads of MaxRequestWorkers, consider raising the MaxRequestWorkers setting
So I edit the /opt/bitnami/apache2/confhttpd.conf
file and add the following, but it is of no use.
<IfModule mpm_event_module>
StartServers 3
ServerLimit 16
MinSpareThreads 75
MaxSpareThreads 250
ThreadsPerChild 25
MaxRequestWorkers 400
MaxConnectionsPerChild 1000
</IfModule>
So after that I was thinking about been attacked by bot/attacker. I used the following command to check my access_log to find any suspicious activity
tail -n 100000 access_log | awk '{print $1}' | sort | uniq -c| sort -nr | head -n 10
And I found result as the following. The IP of 172.26.14.163 is my current instance IP. And it seems that the rest IPs did not request my server heavily. Despite this, I still blocked the first 3 IPs. But it still is of no use util now.
22767 172.26.14.163
518 162.158.165.23
501 172.69.170.127
478 172.69.170.145
468 172.69.170.147
406 3.91.235.204
401 172.69.170.101
399 162.158.166.240
388 172.69.135.17
335 162.158.166.92
I have checked the Access_log last year as well. And the result is almost the same as the above. And the server was not down at that time. So I guess there are no bots/attackers.
I have almost read all the posts related to this issue and done everything I can consider. The problem has not been solved.Could anybody help me. Thanks a lot.