Entire Web Server Hanging from CGI App

On Google, searching for “X-Forwarded-For” with an earlier 2004 date there are already many implementations of this header: Apache, Cisco, Microsoft …

There are more than 10 years!
I even found a Firefox extension in 1991… (X-Forwarded-For Spoofer 1.0.2)

it is a de facto standard for many years.

I added a more accurate feedback:

(https://xojo.com/issue/34272)>]<https://xojo.com/issue/34272>

Yes - I am still on this issue.
Is there nothing I can do in my code to reduce these (below) from happening? There are about 45 of them currently consuming server memory, and there is only one app (a cgi app I wrote) currently running on that server. Aren’t there better insights to what spawns these events, so I can avoid them?

23581 apache 15 0 428m 20m 2280 S 0.0 2.0 0:00.06 /usr/sbin/httpd
21976 apache 15 0 428m 20m 1992 S 0.0 2.0 0:00.01 /usr/sbin/httpd
20413 apache 15 0 428m 20m 1940 S 0.0 2.0 0:00.11 /usr/sbin/httpd
30058 apache 15 0 428m 20m 2052 S 0.0 2.0 0:01.28 /usr/sbin/httpd
… and 40 more

And a similarly larger number of these…

18324 username 19 0 34000 4676 1960 S 0.0 0.4 0:00.04 mycgiapp.cgi
19517 username 15 0 34000 4676 1960 S 0.0 0.4 0:00.04 mycgiapp.cgi
20160 username 15 0 34000 4676 1960 S 0.0 0.4 0:00.05 mycgiapp.cgi

OK - a WordPress website was also running - but didn’t show activity. I put that website into maintenance mode, and immediately, all the events above (previous two posts from me) magically disappeared. Does that offer any deep insights to any of you?

[quote=105543:@olivier vidal]On Google, searching for “X-Forwarded-For” with an earlier 2004 date there are already many implementations of this header: Apache, Cisco, Microsoft …

There are more than 10 years!
I even found a Firefox extension in 1991… (X-Forwarded-For Spoofer 1.0.2)

it is a de facto standard for many years.[/quote]
FF did not exist in 1991
Netscape hadn’t even been released

[quote=106848:@Mark Pastor]Yes - I am still on this issue.
Is there nothing I can do in my code to reduce these (below) from happening? There are about 45 of them currently consuming server memory, and there is only one app (a cgi app I wrote) currently running on that server. Aren’t there better insights to what spawns these events, so I can avoid them?
[/quote]
Apache spawns them
You’d have to see how to configure apache to not spawn so many and how to set their lifetime to be shorter

[quote=106848:@Mark Pastor]Yes - I am still on this issue.
Is there nothing I can do in my code to reduce these (below) from happening? There are about 45 of them currently consuming server memory, and there is only one app (a cgi app I wrote) currently running on that server. Aren’t there better insights to what spawns these events, so I can avoid them?

23581 apache 15 0 428m 20m 2280 S 0.0 2.0 0:00.06 /usr/sbin/httpd
21976 apache 15 0 428m 20m 1992 S 0.0 2.0 0:00.01 /usr/sbin/httpd
20413 apache 15 0 428m 20m 1940 S 0.0 2.0 0:00.11 /usr/sbin/httpd
30058 apache 15 0 428m 20m 2052 S 0.0 2.0 0:01.28 /usr/sbin/httpd
… and 40 more[/quote]

That could be caused by simple app access. If you had hundreds of attempted connections, you could get this behavior.

[quote=106856:@Norman Palardy]FF did not exist in 1991
Netscape hadn’t even been released[/quote]

Yes, it’s weird! And yet this is what is displayed on Google and on the official Mozilla site:

I guess the date of copyright regarding the original software, not the extension itself. There is a comment from 2007 on the page, and Mozilla shows that this extension works with Firefox 1.5 - 3.0, so it’s not really a latest software.

There are still many messages in 2006/2007 it, like this:

http://weblog.jamisbuck.org/2006/10/3/mongrel-ssl-and-apache-1-3

There are 8 years so.

[quote=106849:@Mark Pastor]And a similarly larger number of these…

18324 username 19 0 34000 4676 1960 S 0.0 0.4 0:00.04 mycgiapp.cgi
19517 username 15 0 34000 4676 1960 S 0.0 0.4 0:00.04 mycgiapp.cgi
20160 username 15 0 34000 4676 1960 S 0.0 0.4 0:00.05 mycgiapp.cgi[/quote]

It is strange that a couple have apparently been started at exactly the same time. Is this the case for all of them ?

What constitutes “an attempted connection”?

Anything which connects to your app. A browser, an httpsocket, a command line tool like curl or wget. Anything which requests a file on your server through http will launch a new instance of the .cgi file and potentially the httpd daemon, depending on server load. Each instance of httpd is capable of handling multiple requests, but how many instances get launched is dependent on how apache is configured. It’s not uncommon for apache’s out-of-the-box config to be too much of a memory hog for a small server. You’d need to tweak that yourself, but it largely depend on your needs.

Thank you.

My understanding is this metric reports on CPU time spent on process - not elapsed time or time of day.

When a browser first connects to a new site, it opens several connections because sites typically have lots of assets to deliver in the beginning. Having several processes with the exact same stats can be caused by this.

From what’s been posted, I’m not seeing anything out of the ordinary except that the server appears to be handling LOTS of connections.