Site easily shot down with AB

Reduce MaxClients to 10 or 20. Disable KeepAlives. Restart Apache.

-Chris

Ok but will this also then make some limitations to number of users that can access site per second?

It limits the number of concurrent requests being serviced to 20 (with MaxClients 20). The remaining requests get queued.

Disabling keepalives means that an IDLE browser won't keep one of those slots occupied. It gets in, and gets out - leaving that slot available for someone else.

For example, with MaxClients 20, if each request takes one second, that's about 81.5 million requests per month. Also keep in mind that a 'user' on your site typically makes a bunch of requests and then is done for a while (while they read your wonderful content). So a MaxClients of 20 really means 100s of users… Don't worry about it.

Better this than anyone or a search engine crawler being able to take out your Linode. You want to fix this in any case - webservers tend to ship with unfortunate defaults in distros. We see this all the time.

-Chris

ok this is what i did, i left the max clients to 40 and kept keep alive as-

http://abdussamad.com/archives/169-Apac … r-Off.html">http://abdussamad.com/archives/169-Apache-optimization:-KeepAlive-On-or-Off.html

says it helps with lots of images, and I do have them, lots of them per page. But i limited it to 70 KA requests and timout to 5. Think this could help make it work better, will see if problems occur to put this numbers lower or even disable it memory gets too crowded.

You might want to install nginx in front of your Apache server (or even instead of) to serve your static content, as it can easily handle > 1000 parallel connections. If you have lots of images to serve, nginx or lighttpd are ideal, while Apache is one of the worst webservers to handle this load. It definitely has its uses, but being robust and serving lots of small files isn't one of them :)

Also, it's easy to take down by a bad person, as you already found out. Even if you limit MaxClients to 20, someone can just use a tool like slowloris and DoS your server. :( That's not possible with one of the newer webservers like nginx, lighttpd or Cherokee.