RE: Child processes stuck in R status

On 2025/09/16 18:12:14 [email protected] wrote:
> I'm wondering if anyone has seen this and/or how it is even possible.
> 
> We're having some issues that at least on the surface look like a
> slowloris attack or variant; on the server-status page multiple child
> processes appear to be stuck in R status with large seconds-since
> values.

Hi,

We are seeing this too recently on one of our reverse proxy

The scoreboard is almost saturated with R requests

> __R___R___R_R_RR________RRRRW_RRRRRRR_R__RR_RR_RWRRRRRRRRRRRRRRR
> WRRRRRRRRWRRRRW_RR_RR_RRR__RW_RR_____WR_R____R__________R_______
> ________R__R__________RRRRRR_RR_RR_RRRRR_RRR_RRCRRRWRRRWRRRWW_RR
> RRRRRRRRRR_RRRRRRWRRRRRWRRWRRRRRRRRRRRRRRRRRRWRWRR_WRRRRRRRRRWRR
> RRRRRRWRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRWRRRRRRR_RRRRRRR_RRRR_RRRRR
> __RRRRRRRRRR_RRRWRRRR_RRRRRRRRRRRRRRRRRRWRRRWRRRRRRRRRWRRRRRWRRR
> WRRRRRRRRRRRRR_RRWRRRRRRRRRRRRRRRRRRRRRRR__________________RRRR_
> _RW__RRRRR_RR____WRR_R_RRR_RRRRRRWWRRRRRR_RRRRRRRR_R............
> ..G..........RRRRRRRRRRRCRRRRRRRR_RRRR___________R____RRRR_____R
> R____RRRRRWRR_R_RRR_R___RRRRRRR_RRRRRRRRRR_RRRRRWRRRRRRWR_RRRRRR
> W_RRRRRRRR____R_R_W__RR_RR_R__RRR___R___RWR___R____R_____R_RRRRR
> RRRR_RRRRRR__RRRRRRRRRR_RRRRRRRWRRRR_RRRRR_RR______________R____
> _____R_____________W______WR_______________________________R____
> __________________RRRRRRRRRRRRRRRRRRRRRRRRR_____R_______________
> ______W__W__RR_R_____________...................................
> ........................................

We have changed the number of available workers in the mpm config in 
order to mitigate the saturation : 150 (default on Debian) to 1000 (now)

During this, on lot of R workers server-status shows
- the Client ip
- the VHost domain.example.com:port
- the Request GET or POST /some/path…

This apache instance use

> Server Version: Apache/2.4.65 (Debian) OpenSSL/1.1.1w mod_qos/11.63
> Server MPM: event

On an older apache instance serving the same type of sites

> Server Version: Apache/2.4.10 (Debian) OpenSSL/1.0.1t
> Server MPM: worker

We don't observe these saturations due to R workers
And in server-status the VHost and Request aren't present on R workers, 
only an ip address

What MPM are you using ?
-- 
Grégory Rocher