Is this a DOS attack?

[mnuzum]

Howdy,

I'm experiencing a difficulty with my server, and it's getting me a little frustrated.

For several hours today, my server has been performing slowly. I check and there are 300 http daemons running, which is my max.

This explains the slowness, because when I get into the 200s, I start to run out of ram.

I restart the httpd service and server performance leaps. But within 10 minutes, I have 300 children again.

I went into my httpd.conf file and set this down to 50 for the time being, so I shouldn't run out of RAM. Admittedly, 300 was too high for this server.

The problem is, why is the number of child processes going so high so quickly?

Does anyone know a good way to detect if this is a DOS? I'm checking the error log and the only mention is " server reached MaxClients setting..."

Tailing the access file doesn't show anything extraordinary either.

Any clues?

Thanks,
Matt Nuzum

[dannys]

If you're being DOS'd you'll see loads of different IPs in the access log. You'll also have a lot of incoming traffic.