Apache webserver outage - need help with forensics

[Bob Brennan]

On 4/13/05, Mike Klinke <lsomike at futzin.com> wrote:
> On Wednesday 13 April 2005 10:45, Bob Brennan wrote:
> > I have a server which went completely unresponsive today on port
> > 80 for 20 minutes and would appreciate any pointers as to what
> > might have happened.
> >
> > A bit of background:
> > * FC3, Up2Date
> > * The Apache webserver serves a dozen virtual websites
> > * Sendmail + Dovecot + Squirrelmail for all sites
> > * Spamassasin recently activated (yesterday)
> 
> I assume that Squirrelmail was also unable to deliver http pages.

That is how I first noticed the problem. I have Squirelmail open and
active most of the day receiving my emails. The Inbox frame began
reporting "timeout contacting the server" errors.

> Since Spamassassin is new, take a look at your mail logs around that
> time.

Mail logs show the last email I sent to myself, then a few test emails
from dnscheck as I was testing my services, then a successful POP3
test I did from my phone, then nothing for 15 minutes, then resumption
of normal Squirrelmail services.

I can't find any Spamassasin logs but there were no emails other than
the ones mentioned above that were received duing that time. And the
mailserver was good throughout, it was only httpd that was off.

bob