Xampp using 100% CPU

[Bozzie]

Hello guys, I don't know if anyone on here can help me but my httpd.exe is using 100% CPU sometimes, is there any fixes?

 

[Terrum]

Can you check your Apache logs? Usually that would explain any overloading if there is any. Otherwise try clear your htdocs folder (keeping a backup first of course) to see if the 100% CPU still persists, at least then we can tell if it's an issue with your content or the Apache configuration itself.

 

[Bozzie]

Well here's the thing, it'll range from say 80-100 CPU very quickly (like goes up and down) but it'll prevent people from accessing the site, now when I clear the access log of it's data, it's fine, until it get's into a big file. The access log file goes extremely big in a short amount of time.

 

[Anthologique]

Xampp 100 CPU = DDOS attak

 

[Bozzie]

It's not a ddos attack or I wouldn't be able to get on my VPS.... hahah, plus the client still works its just the website that does down.

 

[Terrum]

Well here's the thing, it'll range from say 80-100 CPU very quickly (like goes up and down) but it'll prevent people from accessing the site, now when I clear the access log of it's data, it's fine, until it get's into a big file. The access log file goes extremely big in a short amount of time.

So what you're trying to say is that when you clear the access logs, the CPU issue stops? Have you actually tried reading what's inside the logs rather than letting it fill up?

 

[MaxZeus]

Hello guys, I don't know if anyone on here can help me but my httpd.exe is using 100% CPU sometimes, is there any fixes?

This is indeed a DDoS Attack, this is called "Layer 7 Attack / GET or POST Flood", it will cause apache to use 100% of CPU and also some ram, depending on your setup. If you check the access_log you will see probably a 'bunch' of entries with a repeated url, that's the behavior of this type of attack.

You can fix it, by using a good Layer 7 mitigation service, taking the forum sponsor one as example :

To view the content, you need to sign in or register

This service will be able to eliminate this issue completely and keep your webserver running properly.

PS: You can still login to your server/vps, because this attack is not able to completely bring your server down, but it is capable of keeping it in a 'busy' condition, hence why the high resource usage.

 

[Terrum]

This is indeed a DDoS Attack, this is called "Layer 7 Attack / GET or POST Flood", it will cause apache to use 100% of CPU and also some ram, depending on your setup. If you check the access_log you will see probably a 'bunch' of entries with a repeated url, that's the behavior of this type of attack.

You can fix it, by using a good Layer 7 mitigation service, taking the forum sponsor one as example :

To view the content, you need to sign in or register

This service will be able to eliminate this issue completely and keep your webserver running properly.

PS: You can still login to your server/vps, because this attack is not able to completely bring your server down, but it is capable of keeping it in a 'busy' condition, hence why the high resource usage.

Can't really say that : As for one, you can't tell the future, and for two, there's no certainty to back that up. I've had Apache issues with XAMPP (the main reason I changed to IIS - which I am actually recommending now to the OP to do. Try IIS) and looked in the logs to see Apache spewing out a lot of debug errors, which IIS seemed to have solved. Nothing DDoS related at all.

 

[Bozzie]

No Terrum he's right I had a-look at the access log and jesus christ it was this

To view the content, you need to sign in or register

anyway, I can't afford the sort of protection no-way, but if it's that how come most Hotels don't get attacked like this surley not everyone has Layer 7 protection.

 

[MaxZeus]

No Terrum he's right I had a-look at the access log and jesus christ it was this

To view the content, you need to sign in or register

anyway, I can't afford the sort of protection no-way, but if it's that how come most Hotels don't get attacked like this surley not everyone has Layer 7 protection.

That's how it works lately, if they can't DDoS you with Layer 4 attacks, they will try Layer 7 attacks and if even that doesn't work, they will start to try exploiting the emulator... So either you are prepared or you are not, there aren't much options.

As you see in your screenshot, that attack is even bypassing CloudFlare , so they will play hard.

 

[Bozzie]

That's how it works lately, if they can't DDoS you with Layer 4 attacks, they will try Layer 7 attacks and if even that doesn't work, they will start to try exploiting the emulator... So either you are prepared or you are not, there aren't much options.

As you see in your screenshot, that attack is even bypassing CloudFlare , so they will play hard.

Yes it's very weird, i've even gone-to block the IP itself on CF and it's saying it's a Cloudflare IP. ****'s fucked up, all I can do that does work is clear the access log which seems to fix it alright

 

[Terrum]

Ah okay, well we would've found that out earlier if you posted the logs earlier I didn't deny it was an attack, I was mostly just saying that you can't say what it definitely is until there's evidence of it.

But moving to IIS would solve this greatly also.

 

[Bozzie]

I would move to IIS but it always causes problems, I just don't want to risk it tbh.

 

[MaxZeus]

I would move to IIS but it always causes problems, I just don't want to risk it tbh.

IIS will not fix this issue, and actually IIS is less efficient than apache, because with apache the multi-threading abstraction is much better and interactive, the thing is whether you are used to do it or not and many people actually don't know about most possible configuration scenarios when dealing with apache, but regarding the attacks, doesn't matter whether this is IIS or Apache, because actually 'both' will use your entire CPU during this type of attack (I'm speaking from experience).

 

[Bozzie]

IIS will not fix this issue, and actually IIS is less efficient than apache, because with apache the multi-threading abstraction is much better and interactive, the thing is whether you are used to do it or not and many people actually don't know about most possible configuration scenarios when dealing with apache, but regarding the attacks, doesn't matter whether this is IIS or Apache, because actually 'both' will use your entire CPU during this type of attack (I'm speaking from experience).

Thanks man, words of wisdom from Max ey? Nice one for letting me know dude.

 

[MaxZeus]

Thanks man, words of wisdom from Max ey? Nice one for letting me know dude.

You are welcome, we are all in the same learning curve

 

[Terrum]

IIS will not fix this issue, and actually IIS is less efficient than apache, because with apache the multi-threading abstraction is much better and interactive, the thing is whether you are used to do it or not and many people actually don't know about most possible configuration scenarios when dealing with apache, but regarding the attacks, doesn't matter whether this is IIS or Apache, because actually 'both' will use your entire CPU during this type of attack (I'm speaking from experience).

Actually, IIS has a lot of decent modules that can help you out. On some occasions I prefer Apache, but for unstable coding where a community is bound to want to immaturely attack you, I stick with IIS. I've used IIS and host about 20+ retros on it without any sort of DDoS issues after installing a few modules - and if I were to move back to Apache I'm sure issues would return

 

[MaxZeus]

Actually, IIS has a lot of decent modules that can help you out. On some occasions I prefer Apache, but for unstable coding where a community is bound to want to immaturely attack you, I stick with IIS. I've used IIS and host about 20+ retros on it without any sort of DDoS issues after installing a few modules - and if I were to move back to Apache I'm sure issues would return

This shows exactly what I said, most people don't know how to properly deal with apache. First step I would recommend you is to really read its documentation (if you have the time for it and the learning interest of course).

Then you will verify that it does have a lot of different systems and methods, to make it be suitable literally for any type of environment, if you just use the 'dev-ready packages' like xampp, you are just losing your time, that's not the correct way to start doing these things. The most common error is using apache in its default bundle as it will have serious performance issues, you might consider using FastCGI implementations over DSO, you might consider using SuPHP instead of interoperating as the running user, you might be interested in not running it as administrator, you also can consider using it as an Event Based system instead of pre-forking and so on. However, you still have a lot to learn and consider before saying what is better and what is not. I am not telling IIS is bad, but I'm saying that 'this comparison' is literally no sense, because there are too many variables to be considered before saying anything.