Question

Why is this monitoring service causing connection resets?

Posted June 11, 2016 2.6k views
Ubuntu Monitoring

In my error log I found the following messages:

[Fri Jun 10 00:22:43.167653 2016] [fcgid:warn] [pid 12111] (104)Connection reset by peer: [client 198.16.7.150:38707] mod_fcgid: ap_pass_brigade failed in handle_request_ipc function
[Fri Jun 10 01:23:40.748637 2016] [fcgid:warn] [pid 14824] (104)Connection reset by peer: [client 198.16.7.150:48198] mod_fcgid: ap_pass_brigade failed in handle_request_ipc function
[Fri Jun 10 02:24:20.421414 2016] [fcgid:warn] [pid 16734] (104)Connection reset by peer: [client 198.16.7.150:55905] mod_fcgid: ap_pass_brigade failed in handle_request_ipc function

Every hour and 5 minutes I get a connection reset from the same IP address.

So I checked my access log and concluded that it comes from a service that I use to check every hour whether our website is still online. I would expect such a service to give be lightweight so I am puzzled. In the access log they each time have two entries like:

198.16.7.150 - - [06/Jun/2016:07:28:27 -0400] "GET / HTTP/1.1" 301 446 "-" "FreeWebMonitoring SiteChecker/0.2 (+http://www.freewebmonitoring.com/bot.html)"
198.16.7.150 - - [06/Jun/2016:07:28:27 -0400] "GET / HTTP/1.1" 500 74399 "-" "FreeWebMonitoring SiteChecker/0.2 (+http://www.freewebmonitoring.com/bot.html)"

What is going on here? Are they doing something strange? Or is my site not supporting something that it should?

Add a comment
musicmouse
By:
musicmouse
Add a comment

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

1 answer
gndo June 13, 2016

Stackoverflow has an answer. A small excerpt from the mod_fcgid documentation that is pointed out in the answer is as follows:

Special PHP considerations

By default, PHP FastCGI processes exit after handling 500 requests, and they may exit after this
module has already connected to the application and sent the next request. When that occurs, an
error will be logged and 500 Internal Server Error will be returned to the client. This PHP behavior can
be disabled by setting PHP_FCGI_MAX_REQUESTS to 0, but that can be a problem if the PHP
application leaks resources. Alternatively, PHP_FCGI_MAX_REQUESTS can be set to a much higher
value than the default to reduce the frequency of this problem. FcgidMaxRequestsPerProcess can be
set to a value less than or equal to PHP_FCGI_MAX_REQUESTS to resolve the problem.

The 301 and 500 http error codes on your post seems to follow from the above excerpt.

Reply Report
  • musicmouse June 13, 2016

    Thank you for your reply.

    Can you help me understand what such a 500 request is and why a monitoring service might use it?

    Reply Report
    • gndo June 13, 2016

      Can you run the following command from your shell prompt to make sure your mod_fcgid version is not buggy (should be 2.3.6 or better):

      apt-cache show libapache2-mod-fcgid

      You can read more about the limits from the mod_fcgid apache documentation.

      Reply Report
      • musicmouse June 14, 2016

        From the resulting text after the apt-cache command:

        Version: 1:2.3.9-1
Depends: libc6 (>= 2.4), apache2-api-20120211

        I don’t understand what this access log data exactly means. If they did cause a 301 or 500 error how would they do that?

        Reply Report
Submit an Answer

Related

Looking for something else?

Ask a new question Search for more help