Litespeed frequently stops

[VagrantRonnie]

Hello guys
It's been couple of times that we have found out that one of our server's litespeed server stops without any warning or reasonable reason. We are using cpanel with LSWS.
I have checked the error_log but found nothing usefull, here is the log of last couple of minutes before server stop.


2014-01-27 09:48:17.325 [INFO] [config:server:basic] For better obscurity, server version number is hidden in the response header.
2014-01-27 09:48:17.338 [NOTICE] [PID: 304809]: start cgid: 304810, /usr/local/lsws/bin/httpd
2014-01-27 09:48:17.339 [NOTICE] The maximum number of file descriptor limit is set to 4096.
2014-01-27 09:48:17.340 [NOTICE] [config] Cache function requires a 2-CPU license or above.
2014-01-27 09:48:17.340 [WARN] [config:server:epsr:lsphp54] Improper configuration: the value of PHP_LSAPI_CHILDREN should not be less than 'Max connections', 'Max connections' is reduced to 35.
2014-01-27 09:48:17.381 [NOTICE] [config:server:rails] Cannot find ruby interpreter, Rails easy configuration is turned off
2014-01-27 09:48:17.452 [INFO] Processing config file: /usr/local/apache/conf/includes/pre_main_global.conf
2014-01-27 09:48:17.460 [INFO] Processing config file: /usr/local/apache/conf/includes/pre_main_2.conf
2014-01-27 09:48:17.461 [INFO] Processing config file: /usr/local/apache/conf/modhostinglimits.conf
2014-01-27 09:48:17.471 [INFO] Processing config file: /usr/local/apache/conf/php.conf
2014-01-27 09:48:17.481 [INFO] Processing config file: /usr/local/apache/conf/includes/errordocument.conf
2014-01-27 09:48:17.490 [INFO] Processing config file: /usr/local/apache/conf/modsec2.conf
2014-01-27 09:48:17.503 [ERROR] [ModSecurity] unknown server variable while parsing: MULTIPART_STRICT_ERROR
2014-01-27 09:48:17.503 [INFO] Processing config file: /usr/local/apache/conf/modsec2.user.conf
2014-01-27 09:48:17.582 [INFO] Processing config file: /usr/local/apache/conf/modsec2.whitelist.conf
2014-01-27 09:48:17.678 [INFO] Processing config file: /usr/local/apache/conf/includes/pre_virtualhost_global.conf
2014-01-27 09:48:17.678 [INFO] Processing config file: /usr/local/apache/conf/includes/pre_virtualhost_global.conf
2014-01-27 09:48:17.681 [INFO] Processing config file: /usr/local/apache/conf/includes/pre_virtualhost_2.conf
2014-01-27 09:48:17.681 [INFO] Processing config file: /usr/local/apache/conf/includes/pre_virtualhost_2.conf
2014-01-27 09:48:17.728 [INFO] Processing config file: /usr/local/apache/conf/includes/post_virtualhost_global.conf
2014-01-27 09:48:17.728 [INFO] Processing config file: /usr/local/apache/conf/includes/post_virtualhost_global.conf
2014-01-27 09:48:17.729 [INFO] Processing config file: /usr/local/apache/conf/includes/post_virtualhost_2.conf
2014-01-27 09:48:17.729 [INFO] Processing config file: /usr/local/apache/conf/includes/post_virtualhost_2.conf
2014-01-27 09:48:17.852 [INFO] [2.181.26.56:3485-0#APVH_zarinneda.com] File not found [/home/zarinned/public_html/Pictures/85.gif]
2014-01-27 09:48:17.852 [INFO] [2.181.26.56:3485-0#APVH_zarinneda.com] File not found [/home/zarinned/public_html/404.shtml]
2014-01-27 09:48:26.872 [NOTICE] [AutoRestarter] cleanup children processes and unix sockets of process with pid=296605 !
2014-01-27 09:48:26.873 [INFO] [CLEANUP] Send signal: 10 to process: 303155
2014-01-27 09:48:26.873 [NOTICE] [AutoRestarter] child process with pid=296605 exited with status=0!
2014-01-27 09:48:26.873 [NOTICE] [PID:296599] Server Stopped!

 

[mistwang]

Looks normal, need to look for log entries about
PID 304809

that's the current http main server process.
We may need to full log for analysis, the partial log does not help. please PM or send to bug@litespeed...

 

[VagrantRonnie]

The whole log file is 127MB and is containing thousand of lines. how do I send it here?
Beside rest of the log file is seems normal, that's reason it was so wierd to me and I opened this thread.

Looks normal, need to look for log entries about
PID 304809

that's the current http main server process.
We may need to full log for analysis, the partial log does not help. please PM or send to bug@litespeed...

 

[mistwang]

If there was no log entry about PID > 304809 and all lshttpd processes are dead, it means some process killed all lshttpd with signal 9. You need to find out what software package does that, some anti-hacking script may do that.
If there are still lshttpd process alive, it is another story, need to check what those lshttpd processes were doing with "lsof"