我一直在CentOS 5服务器上运行一个网站大约一年。 一切都很好，直到我注意到我的服务器上奇怪的停机问题。 我只是看看系统图，我看到系统内存已经超出，然后Apache服务脱机。
到目前为止，我一直在接受这种types的停机，但是我不知道可能是什么问题。
我有一些日志文件，我发现了一些奇怪的东西，但我不知道是否相关。
当服务器closures时，我在var/log/httpd/ssl_error_log得到这个日志
[Thu Oct 31 *** 2013] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Thu Oct 31 *** 2013] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Thu Oct 31 *** 2013] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Thu Oct 31 *** 2013] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Thu Oct 31 *** 2013] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Thu Oct 31 *** 2013] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Thu Oct 31 *** 2013] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Thu Oct 31 *** 2013] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
我也注意到，昨天，我的var/log/secure已经logging了另一个ip比我的或服务器的一些行动。
Oct 30 *** server1 pure-ftpd: (?@***) [INFO] New connection from *** Oct 30 *** server1 pure-ftpd: (?@***) [INFO] Anonymous user logged in Oct 30 *** server1 pure-ftpd: (ftp@***) [ERROR] Can't open that file: Permission denied Oct 30 *** server1 pure-ftpd: (ftp@***) [ERROR] Can't open that file: Permission denied Oct 30 *** server1 pure-ftpd: (ftp@***) [INFO] Can't change directory to public: No such file or directory Oct 30 *** server1 pure-ftpd: (ftp@***) [INFO] Can't change directory to incoming: No such file or directory Oct 30 *** server1 pure-ftpd: (ftp@***) [INFO] Can't change directory to incoming: No such file or directory Oct 30 *** server1 pure-ftpd: (ftp@***) [INFO] Can't change directory to _vti_pvt: No such file or directory Oct 30 *** server1 pure-ftpd: (ftp@***) [INFO] Can't change directory to upload: No such file or directory Oct 30 *** server1 pure-ftpd: (ftp@***) [INFO] Logout.
这意味着有人侵入我的系统？
任何人都可以提出什么可能是这个问题，我该如何解决？ 我可以发布更多的日志，如果你需要指定哪个！
当发生停机时，错误日志显示如下：
[Thu Oct 31 *** 2013] [error] server reached MaxClients setting, consider raising the MaxClients setting [Thu Oct 31 *** 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Thu Oct 31 *** 2013] [warn] RSA server certificate wildcard CommonName (CN) `*.lxlabs.com' does NOT match server name!? [Thu Oct 31 *** 2013] [notice] ModSecurity for Apache/2.6.7 (http://www.modsecurity.org/) configured. [Thu Oct 31 *** 2013] [notice] ModSecurity: APR compiled version="1.2.7"; loaded version="1.3.12" [Thu Oct 31 *** 2013] [warn] ModSecurity: Loaded APR do not match with compiled! [Thu Oct 31 *** 2013] [notice] ModSecurity: PCRE compiled version="6.6 "; loaded version="8.02 2010-03-19" [Thu Oct 31 *** 2013] [warn] ModSecurity: Loaded PCRE do not match with compiled! [Thu Oct 31 *** 2013] [notice] ModSecurity: LUA compiled version="Lua 5.1" [Thu Oct 31 *** 2013] [notice] ModSecurity: LIBXML compiled version="2.6.26" [Thu Oct 31 *** 2013] [notice] Digest: generating secret for digest authentication ... [Thu Oct 31 *** 2013] [notice] Digest: done [Thu Oct 31 *** 2013] [warn] RSA server certificate wildcard CommonName (CN) `*.lxlabs.com' does NOT match server name!? [Thu Oct 31 *** 2013] [notice] Apache/2.2.22 (Unix) DAV/2 PHP/5.2.17 mod_ssl/2.2.22 OpenSSL/0.9.8e-fips-rhel5 configured -- resuming normal operations [Thu Oct 31 *** 2013] [notice] caught SIGTERM, shutting down [Thu Oct 31 *** 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Thu Oct 31 *** 2013] [warn] RSA server certificate wildcard CommonName (CN) `*.lxlabs.com' does NOT match server name!? [Thu Oct 31 *** 2013] [notice] ModSecurity for Apache/2.6.7 (http://www.modsecurity.org/) configured. [Thu Oct 31 *** 2013] [notice] ModSecurity: APR compiled version="1.2.7"; loaded version="1.3.12" [Thu Oct 31 *** 2013] [warn] ModSecurity: Loaded APR do not match with compiled! [Thu Oct 31 *** 2013] [notice] ModSecurity: PCRE compiled version="6.6 "; loaded version="8.02 2010-03-19" [Thu Oct 31 *** 2013] [warn] ModSecurity: Loaded PCRE do not match with compiled! [Thu Oct 31 *** 2013] [notice] ModSecurity: LUA compiled version="Lua 5.1" [Thu Oct 31 *** 2013] [notice] ModSecurity: LIBXML compiled version="2.6.26" [Thu Oct 31 *** 2013] [notice] Digest: generating secret for digest authentication ... [Thu Oct 31 *** 2013] [notice] Digest: done [Thu Oct 31 *** 2013] [warn] RSA server certificate wildcard CommonName (CN) `*.lxlabs.com' does NOT match server name!? [Thu Oct 31 *** 2013] [notice] Apache/2.2.22 (Unix) DAV/2 PHP/5.2.17 mod_ssl/2.2.22 OpenSSL/0.9.8e-fips-rhel5 configured -- resuming normal operations