Environment:

IBM HTTP SERVER: 1.3.19.4
PORTAL SERVER: 4.2.1 Extend
APP SERVER: 4.0.5

Have checked log files in all nothing unexpected, restarted app server
also.

Initial portal page is set of static portlets

Michael

[ Post a follow-up to this message ]

Exactly what symptoms are you seeing? How many concurrent connections are
open with IHS when the IHS crashes?

Sunit

<Michael.Wall@connectcgs.com> wrote in message
news:cug1fd$2t0m$2@news.boulder.ibm.com...
> Environment:
>
> IBM HTTP SERVER: 1.3.19.4
> PORTAL SERVER: 4.2.1 Extend
> APP SERVER: 4.0.5
>
> Have checked log files in all nothing unexpected, restarted app server
> also.
>
> Initial portal page is set of static portlets
>
> Michael

[ Post a follow-up to this message ]

IHS crashed only once, symptom is slowness to open initial page
(index.html with redirect to .../wps/portal) some of time, not all. Once
logged in, there are no issues. There are around 200 threads for httpd.
when I stop and start, httpd appears with loads of threads, despite .conf
settings. No issies that I can see on app/portal server, logs all as
expected.

[ Post a follow-up to this message ]

When this problem occurs next time, can you check number of threads being
used in your web container? Currently defined sizing can be checked using
adminclient. Thread usage can be checked using Resource Analyzer.

Sunit

<Michael.Wall@connectcgs.com> wrote in message
news:cug40a$eom$1@news.boulder.ibm.com...
> IHS crashed only once, symptom is slowness to open initial page
> (index.html with redirect to .../wps/portal) some of time, not all. Once
> logged in, there are no issues. There are around 200 threads for httpd.
> when I stop and start, httpd appears with loads of threads, despite .conf
> settings. No issies that I can see on app/portal server, logs all as
> expected.

[ Post a follow-up to this message ]

Sunit,
Thanks for your help, the ISP got back to me, postfix was running on the
box, was being used as a spam relay. hadn't been removed from startup
which was causing the performance issues.

this doesn't explain the initial crash though, but with postfix shut down
preformance is back to expected.

[ Post a follow-up to this message ]

You don't think the fact your host was cracked doesn't possibly explain
the initial crash? What if the inital crash was the buffer overflow that
let them in?

Michael.Wall@connectcgs.com wrote:
> Sunit,
> Thanks for your help, the ISP got back to me, postfix was running on the
> box, was being used as a spam relay. hadn't been removed from startup
> which was causing the performance issues.
>
> this doesn't explain the initial crash though, but with postfix shut down
> preformance is back to expected.

[ Post a follow-up to this message ]

Did you check your error_log? Also check for any core files created at that
time. You might have been hit by a buffer overflow vulnerability.

Sunit

<Michael.Wall@connectcgs.com> wrote in message
news:cuipto$3buu$1@news.boulder.ibm.com...
> Sunit,
> Thanks for your help, the ISP got back to me, postfix was running on the
> box, was being used as a spam relay. hadn't been removed from startup
> which was causing the performance issues.
>
> this doesn't explain the initial crash though, but with postfix shut down
> preformance is back to expected.

[ Post a follow-up to this message ]