[imp] Horde/IMP causing too many open files error?

[kareemy]

On 7/25/05, Andrew Morgan <morgan at orst.edu> wrote:
> 
> On Mon, 25 Jul 2005, kareemy wrote:
> 
> > On 7/25/05, Jan Schneider <jan at horde.org> wrote:
> >> Zitat von kareemy <kareemy at gmail.com>:
> >>
> >>> I checked the access_log and noticed a possible suspicious entry.
> >>>
> >>> XXX - - [23/Jul/2005:07:26:19 -0500] "GET
> >>> /horde/imp/login.php?url=%2Fhorde%2Fservices%2Fportal%2Fsidebar.php%3Fhttpclient%3D1%26amp%3Bnocache%3D74gi8y491ns4
> >>> HTTP/1.1" 200 2856
> >>>
> >>> The same IP address kept performing GET requests on this same url for
> >>> several days with about 5 minute intervals. The only difference in the
> >>> url were the final 11 characters appeared to change randomly. I
> >>> believe that constant berage caused the Too many open files error. The
> >>> horde_log file shows tons of
> >>>
> >>> Jul 23 03:54:55 HORDE [notice] [imp] XXX  [on line 31 of
> >>> "/horde/imp/login.php"]
> >>>
> >>> lines.
> >>>
> >>> I am having trouble deciphering the GET request. I haven't seen any
> >>> url formed that way at all before in my log files. Would the horde or
> >>> imp ever normally construct such a url? Under what circumstances?
> >>
> >> This URL is requested if a client that is not (or no longer) logged in
> >> tries to refresh the sidebar in the background. I guess it's some
> >> browser kept open while the user left his computer. With a frequency of
> >> one request per 5 minutes this shouldn't cause any problems though.
> >>
> >> Jan.
> >
> > That is what I suspected. However, I restarted apache and have let
> > these requests continue to come in and I've noticed apache is slowly
> > but surely using up more and more file descriptors. I am running
> > OpenBSD 3.7 and monitoring the number of open files for the www user
> > using the fstat command. When I first restarted apache fstat reported
> > 111 open files. After about an hour of being bombarded by the same
> > request I mentioned above fstat is now reporting that the www user has
> > 153 files open. At this rate it seems reasonable that apache will
> > exceed its max file descriptor quota within a short period of time
> >
> > Is there anything in the horde or imp that could cause apache to open
> > files and keep them open like this, or is this normal behavior and I
> > should simply increase the max file descriptors available to apache?
> 
> Perhaps the connections aren't running to completion?  I'd look at the
> output of 'lsof' to see exactly which files are staying open.
> 
>         Andy

Andy,

lsof shows more  /var/www/logs/ssl_scache.db files opened. That is, I
ran lsof at one point then about 20 minutes later. The only difference
was 4 more ssl_scache.db files opened by apache. (I just ran lsof
again and there are 8 more ssl_scache.db files opened compared with
the first run).  The rest of the open files are just directories,
shared objects, and some other log files.The ssl_scache.db file seems
to be the culprit.

I am not very familar with this file. I checked my httpd.conf and
found these settings:

SSLSessionCache         dbm:logs/ssl_scache
SSLSessionCacheTimeout  300

What would cause apache to keep opening more ssl_scache.db files and
what do you think would be a good solution? I thought apache already
would drop connections that did not complete after a certain timeout
interval. Can I configure something like that?

Thanks,
Kareem