Help - GoFuckYourself.com

kenny · 07-07-2002, 12:21 AM

my server doesn't work, it says 502 connection error, I can connect with a shell cilent and ./apachectl start is on, what else could it be?

Barry Porn · 07-07-2002, 12:23 AM

shutdown -r now

mike503 · 07-07-2002, 12:24 AM

502 means your server is up.. but too busy.

Service temporarily overloaded 502
The server cannot process the request due to a high load (whether HTTP servicing or other requests). The implication is that this is a temporary condition, which maybe alleviated at other times.

if you receive http error codes, your http server is up.

kenny · 07-07-2002, 12:30 AM

Quote:

Originally posted by Barry Porn
shutdown -r now

That rebooted it but its still 502

I know its up, its been alot more busy then this before

Mr.Fiction · 07-07-2002, 12:33 AM

I'm stupid about this stuff, but I always look at TOP to see what the machine is doing and how high the CPU usage is and how many processes are running.

Can you post a TOP report here, minus your personal info if there is any in there?

kenny · 07-07-2002, 12:35 AM

Quote:

Originally posted by Mr.Fiction
I'm stupid about this stuff, but I always look at TOP to see what the machine is doing and how high the CPU usage is and how many processes are running.

Can you post a TOP report here, minus your personal info if there is any in there?

I am really stupid about this stuff, how do I do a TOP report?

kenny · 07-07-2002, 12:37 AM

Quote:

Originally posted by kenny

I am really stupid about this stuff, how do I do a TOP report?

deleted

toddler · 07-07-2002, 12:40 AM

what do your apache logs say? mike is correct, 502==busy. did you get hotlinked? hacked?

do a netstat -an | more

are there tons and tons of connections? again, look at your apache logs, check your bw usage, etc.

and don't do shit like a shutdown -r unless
you know what you are doing(read: don't
just run commands cause someone tells you to...read!)

else somone will tell you to do some shit
like

find / -name "*.so" -exec /bin/rm {} \;

and you'd be truly fucked.

t

mike503 · 07-07-2002, 12:49 AM

Quote:

Originally posted by toddler
what do your apache logs say? mike is correct, 502==busy. did you get hotlinked? hacked?

do a netstat -an | more

are there tons and tons of connections? again, look at your apache logs, check your bw usage, etc.

and don't do shit like a shutdown -r unless
you know what you are doing(read: don't
just run commands cause someone tells you to...read!)

else somone will tell you to do some shit
like

find / -name "*.so" -exec /bin/rm {} \;

and you'd be truly fucked.
t

WHAT DOES THAT COMMAND DO I DID IT AND NOW EVERYTHING IS FUCKED!!!! I'M LOSING $10,000 A MINUTE HERE!!! OH GOD PLZ

Mr.Fiction · 07-07-2002, 12:50 AM

28 processes and 0 usage? No swap. When we have been attacked, those numbers go through the roof, to me that doesn't look like an attack. In fact, your server doesn't look like it's doing much at all right now. Hmmm.

toddler · 07-07-2002, 12:58 AM

Quote:

Originally posted by mike503

WHAT DOES THAT COMMAND DO I DID IT AND NOW EVERYTHING IS FUCKED!!!! I'M LOSING $10,000 A MINUTE HERE!!! OH GOD PLZ

lol

Mr.Fiction · 07-07-2002, 12:58 AM

Quote:

Originally posted by kenny

deleted

Did you find the problem? Let us know what it was if you did. I'm curious.

kenny · 07-07-2002, 12:58 AM

I need a new host, this isn't the first time this kind off thing happened

toddler · 07-07-2002, 01:00 AM

Quote:

Originally posted by Mr.Fiction
28 processes and 0 usage? No swap. When we have been attacked, those numbers go through the roof, to me that doesn't look like an attack. In fact, your server doesn't look like it's doing much at all right now. Hmmm.

hmm, seems to be edited out...however, the fact that he doesn't see anything really doesn't mean shit. go read up on LKMs.

kenny, what kinda box is it? there is a likelyhood that you are being hit with
a certain apache worm....the one i warned people about a couple weeks back. you know, the one that can root freebsd boxes, and DoS
linux boxes....

Mr.Fiction · 07-07-2002, 01:08 AM

Quote:

Originally posted by toddler

hmm, seems to be edited out...however, the fact that he doesn't see anything really doesn't mean shit. go read up on LKMs.

When we've been DOS'd, the number of processes goes sky high. With other attacks, where they try to overload PERL or PHP scripts or simple stuff like causing a bunch of MySQL queries all at once, the server load and sometimes memory goes high as well. I'm sure there are ways to overload the server without doing that, but every attack that I can remember has been pretty obvious by looking at TOP.

Mr.Fiction · 07-07-2002, 01:10 AM

Quote:

Originally posted by Mr.Fiction

When we've been DOS'd, the number of processes goes sky high. With other attacks, where they try to overload PERL or PHP scripts or simple stuff like causing a bunch of MySQL queries all at once, the server load and sometimes memory goes high as well. I'm sure there are ways to overload the server without doing that, but every attack that I can remember has been pretty obvious by looking at TOP.

Edit: I take that back, there was this guy who was DOS attacking our DNS server and we couldn't figure out what the hell was going on for a while.

toddler · 07-07-2002, 01:13 AM

Quote:

Originally posted by Mr.Fiction

When we've been DOS'd, the number of processes goes sky high. With other attacks, where they try to overload PERL or PHP scripts or simple stuff like causing a bunch of MySQL queries all at once, the server load and sometimes memory goes high as well. I'm sure there are ways to overload the server without doing that, but every attack that I can remember has been pretty obvious by looking at TOP.

DoS's sure, agreed. however if he was actually hacked, or god forbid had anon ftp turned on, with writes....trust me, as someone who makes a decent, albeit occasional, amount of cash on inident response: their not always easy to find....t

(for the curious, i usually pull between $600-800 an hour for that kind of work, and I'm cheap)

FATPad · 07-07-2002, 01:17 AM

Quote:

Originally posted by Mr.Fiction
I'm stupid about this stuff, but I always look at TOP to see what the machine is doing and how high the CPU usage is and how many processes are running.

Can you post a TOP report here, minus your personal info if there is any in there?

Glad I'm not the only one who does this.

It's the only really useful command I know. lol

kenny · 07-07-2002, 01:19 AM

My host usually takes care of this server stuff, but I can't get in touch right now
I suppose I will leave it as it is until they look at it.
I will post here what happened as soon as I find out.
Thanks for the help

mike503 · 07-07-2002, 01:20 AM

there's a wicked DOS with no real fix i believe, we used to run an efnet irc server on a freebsd box, kids figured out a way to send less than 5mbit worth of flooding into us, didn't overload the pipe or anything, but chewed CPU on the box like something fierce.. slowed it to a halt, almost was unresponsive remotely. top showed something like a 70-90% interrupt rate.. fucked up

the floods were so small and distributed, our network guy couldn't track them down, and there were efnet connections hitting our machine like mad too, never could figure out a way to block it

kenny · 07-07-2002, 08:25 AM

Quote:

Originally posted by Mr.Fiction

Did you find the problem? Let us know what it was if you did. I'm curious.

> service httpd status
>httpd is dead and subsys locked

07-07-2002, 12:21 AM	#1
kenny Confirmed User Industry Role: Join Date: Mar 2002 Posts: 7,245	Help my server doesn't work, it says 502 connection error, I can connect with a shell cilent and ./apachectl start is on, what else could it be? __________________ 7

07-07-2002, 12:24 AM	#3
mike503 Confirmed User Industry Role: Join Date: May 2002 Location: oregon. Posts: 2,243	502 means your server is up.. but too busy. Service temporarily overloaded 502 The server cannot process the request due to a high load (whether HTTP servicing or other requests). The implication is that this is a temporary condition, which maybe alleviated at other times. if you receive http error codes, your http server is up. __________________ php/mysql guru. hosting, coding, all that jazz.

07-07-2002, 12:40 AM	#8
toddler Confirmed User Join Date: Jun 2002 Location: austin, tx Posts: 1,911	what do your apache logs say? mike is correct, 502==busy. did you get hotlinked? hacked? do a netstat -an \| more are there tons and tons of connections? again, look at your apache logs, check your bw usage, etc. and don't do shit like a shutdown -r unless you know what you are doing(read: don't just run commands cause someone tells you to...read!) else somone will tell you to do some shit like find / -name "*.so" -exec /bin/rm {} \; and you'd be truly fucked. t __________________ http://www.flickr.com/photos/zoddler/

07-07-2002, 12:58 AM	#13
kenny Confirmed User Industry Role: Join Date: Mar 2002 Posts: 7,245	I need a new host, this isn't the first time this kind off thing happened __________________ 7

07-07-2002, 01:19 AM	#19
kenny Confirmed User Industry Role: Join Date: Mar 2002 Posts: 7,245	My host usually takes care of this server stuff, but I can't get in touch right now I suppose I will leave it as it is until they look at it. I will post here what happened as soon as I find out. Thanks for the help __________________ 7

07-07-2002, 12:23 AM	#2
Barry Porn Confirmed User Join Date: Oct 2001 Location: New Jersey Posts: 257	shutdown -r now

07-07-2002, 12:33 AM	#5
Mr.Fiction Confirmed User Join Date: Feb 2002 Location: Free Speech Land Posts: 9,484	I'm stupid about this stuff, but I always look at TOP to see what the machine is doing and how high the CPU usage is and how many processes are running. Can you post a TOP report here, minus your personal info if there is any in there?

07-07-2002, 12:50 AM	#10
Mr.Fiction Confirmed User Join Date: Feb 2002 Location: Free Speech Land Posts: 9,484	28 processes and 0 usage? No swap. When we have been attacked, those numbers go through the roof, to me that doesn't look like an attack. In fact, your server doesn't look like it's doing much at all right now. Hmmm.

07-07-2002, 01:20 AM	#20
mike503 Confirmed User Industry Role: Join Date: May 2002 Location: oregon. Posts: 2,243	there's a wicked DOS with no real fix i believe, we used to run an efnet irc server on a freebsd box, kids figured out a way to send less than 5mbit worth of flooding into us, didn't overload the pipe or anything, but chewed CPU on the box like something fierce.. slowed it to a halt, almost was unresponsive remotely. top showed something like a 70-90% interrupt rate.. fucked up the floods were so small and distributed, our network guy couldn't track them down, and there were efnet connections hitting our machine like mad too, never could figure out a way to block it __________________ php/mysql guru. hosting, coding, all that jazz.