Apache problem can affect the entire server.
The current Apache limits are shown below, which are also set to the default values.
The following articles provide more information of what you can do to resolve this problem.
MaxRequestWorkers and DDoS
How can I tell if Apache is experiencing a DDoS attack?
You can resolve it by raising the Apache limits, but you will want to do this in increments as well. If you notice that problems are still occurring after modifying the limits, you may need to review the logs to see if any offending IPs are attacking the server. I have provided a list of the top IP connections to your server with the IP itself and the number of connections today.
If any of these IPs are problematic, you can try blocking the connections, but I suggest you first start with the PHP-FPM adjustments or disable PHP-FPM for the problem sites.
With the Apache problem, this seems to have been encountered less frequently but it has occurred several times in the last few days.
# grep 'MaxRequestWorkers' /usr/local/apache/logs/error_log
[Tue Nov 18 17:27:00.590507 2025] [mpm_prefork:error] [pid 3243:tid 3243] AH00161: server reached MaxRequestWorkers setting, consider raising the MaxRequestWorkers setting
[Wed Nov 19 11:28:39.530182 2025] [mpm_prefork:error] [pid 3231:tid 3231] AH00161: server reached MaxRequestWorkers setting, consider raising the MaxRequestWorkers setting
[Fri Nov 21 20:03:31.287851 2025] [mpm_prefork:error] [pid 3054:tid 3054] AH00161: server reached MaxRequestWorkers setting, consider raising the MaxRequestWorkers settingThe current Apache limits are shown below, which are also set to the default values.
# grep -Ei "(MaxRequestWorkers|ServerLimit)" /etc/apache2/conf/httpd.conf
ServerLimit 256
MaxRequestWorkers 150The following articles provide more information of what you can do to resolve this problem.
MaxRequestWorkers and DDoS
How can I tell if Apache is experiencing a DDoS attack?
You can resolve it by raising the Apache limits, but you will want to do this in increments as well. If you notice that problems are still occurring after modifying the limits, you may need to review the logs to see if any offending IPs are attacking the server. I have provided a list of the top IP connections to your server with the IP itself and the number of connections today.
# grep -iR "21\/Nov\/2025" /etc/apache2/logs/domlogs/ | awk -F: '{print $2}' | awk {'print $1'} | sort -rn | uniq -c | sort -rn | head -n 20
28712 191.101.42.41
17892 128.199.119.83
11128 154.73.92.52
11055 48.210.83.7
7784 41.111.168.17
7710 48.210.228.230
6496 185.104.184.204
4470 185.208.158.157
4237 172.190.142.176
3262 154.121.43.255
3216 197.200.41.236
3162 172.207.169.113
3012 172.177.121.115
2910 20.37.101.92
2898 193.142.146.65
2603 20.10.27.223
2584 74.176.50.59
2534 74.176.50.101
2278 134.149.18.28
1912 51.89.204.24If any of these IPs are problematic, you can try blocking the connections, but I suggest you first start with the PHP-FPM adjustments or disable PHP-FPM for the problem sites.
Pour voir les détailles de max children sur PHP81
grep max_children /opt/cpanel/ea-php81/root/usr/var/log/php-fpm/error.log
perl -lane 'print if /journalabc-ar/ and /max_children/' /opt/cpanel/ea-php81/root/usr/var/log/php-fpm/error.log | taills /opt/cpanel/ea-php*/root/usr/var/log/php-fpm/error.log | while read log ; do echo ${log} ; perl -lane 'if (@F[0] =~ "24-Nov-2025" and /server reached max_children/ and @F[3] =~ "pool") {my $output = @F[4] ; my @domain = split /]/, $output ; print @domain[0] =~ s/\_/\./gr }' ${log} | sort | uniq -c | sort -nr ; done
/opt/cpanel/ea-php74/root/usr/var/log/php-fpm/error.log
/opt/cpanel/ea-php80/root/usr/var/log/php-fpm/error.log
/opt/cpanel/ea-php81/root/usr/var/log/php-fpm/error.log
Cérifier si tu as une attaque (DDoS ou bot)
Voir les IP avec beaucoup de connexions :
Commentaires
Enregistrer un commentaire