Server closes ports for short time without any reason

For the purpose of website hosting as well as for the storing the data from our solar telescope we use Dell PowerEdge T110 server (http://oh.geof.unizg.hr). Server is running for more than 6 monts stable and it is connected to APC UPS.

Server runs on SUSE 11.4, together with Apache 2.2.17, mysql 5.3.5, ftp and ssh (only this ports are open).

Unfortunately, since we changed server (to Dell) we experience strange problems which we can’t eliminate.

  • Server closes all ports for some short time without any reason (tested with nmap). Once it closes the ports it can last from few seconds to some minutes (up 15-30min) to open again the ports. It is the most pronounced when the server pages are accessed for first time. During that time all services are not accessible (like webpages) but we can still ping the server. We checked and all services are running ok during that time.
  • Removal of firewall didn’t had any effect
  • In case that let say webpages are accessed locally on the server in the time during it closes the ports – it has also some delay about few seconds to show the page. When it start to run locally it runs also from outside.

Does anybody know what should we look for? I don’t have any solution except to change the whole machine… :frowning: web server which works ok but then occasionally doesn’t work isn’t a happy solution…

We tested together with local system admins local network and concluded that the problem isn’t in the network connection to the computer (99% of chance).

Thak you for your help!

With best regards,
Jasa

You say the ports are closed, i.e. the network is throttling but are you sure? Maybe you can try and change the network card to be sure is this.

No hints in the logs when this happens, what’s the machine load (top / htop), what happens to the accessed files load (iotop)?

Is the machine usable when this happens, e.g. from the shell? What is the system log saying?

Try increasing the logging verbosity for apache and mysql and looks for what happens when the ‘network throttle’.

What apache modules are loaded?

How is the server connected to the internet?

Cheers.

Sorry this seems to be quite difficult problem to explain just in one post. :frowning:

I’d say that the problem is not in network card…

It seems that with network is all fine since I can ping the machine also when web, ssh and ftp are down (btw. everything goes down simultaneously) and respectively the ports are closed.

It could be something with some virtual interface which probably (I don’t know out of which reason) pops up and close the ports.

There is also one interesting thing on the server: its eth0 MAC address is B8:AC:6F:8D:B8:67, when it is down ping shows MAC address B8:AC:6F:8D:B8:68 (for the number higher than original MAC)?

Today as I was having top in putty and as I accessed the webpage via web browser simultaneously, server closed the ports and ssh connection was gone (maybe is triggered by web access). But it just froze to show still the process httpd2-prefork to be active (8291 wwwrun 20 0 295m 29m 3796 S 5 0.7 0:00.33 httpd2-prefork) which is to be expected.
Maybe there is better way to pinpoint down the process which could close the ports?

Almost all the time machine load is almost 0 (there is not so much interest in science web pages)…
Machine is connected to university network but the problems are the same regardless if I use local network (one switch away) or access it from outside. Server is usable when it happens (all services running) – there is no difference when I use it locally, except that it needs some longer time to load webpage locally.

BTW. Which logs would be useful to check?

I’m also not sure if has to do with apache modules since it affects ftp and ssh too!
oh:/etc/apache2 # httpd2 -l
Compiled in modules:
core.c
prefork.c
http_core.c
mod_so.c

Thanks for your help!

On 02/10/2012 06:16 PM, jcalogov wrote:
> Server runs on SUSE 11.4

-=WELCOME=- new poster…

there is no “SUSE 11.4”, but there is an openSUSE 11.4 and also a SUSE
Linux Enterprise Server (SLES) version 11…which is it that you are
running.

i ask because i believe that PowerEdge is certified to run several
versions of Red Hat and SLES, but neither Fedora or openSUSE…

so, i assume you are, or should be, running SLES 11 and are therefore in
the wrong forum…the SLES gurus hang out in http://forums.suse.com/
and the ID/pass you used here works there…

if you are not absolutely sure what operating system you are running,
you can learn that with this in a terminal:


cat /etc/SuSE-release


DD http://tinyurl.com/DD-Caveat
Read what Distro Watch writes: http://tinyurl.com/SUSEonDW

I’m absolutely sure - we are running OpenSuSE 11.4! :slight_smile:

cat issue
Welcome to openSUSE 11.4 “Celadon” - Kernel \r (\l).