Symptoms
You may receive an email notification saying the following:
The service “httpd” appears to be down.
Description
Effectively, this means that Apache (httpd) is not reachable. The chksrvd service checks if Apache is available by sending a GET request over port 80 as shown below:
[root@centos7 centos] cat /etc/chkserv.d/httpd
service[httpd]=80,GET / HTTP/1.0,HTTP/1
And per the server's notification settings, an email notification may be sent regarding Apache appearing to be down, as it's not reachable.
Potential Cause
In some cases, Apache may actually be running but may have reached its MaxRequestWorkers setting.
To determine that this is the cause, first, you may check that Apache is running with the following command:
[root]cPs# /scripts/restartsrv_httpd --status
httpd (/usr/sbin/httpd -k start) is running as root with PID 9095 (systemd+/proc check method).
If it's running, then use the following command to check for information about MaxRequestWorkers being hit:
[root]cPs# grep MaxRequestWorkers /etc/apache2/logs/error_log | tail -n2
[Fri Apr 02 13:20:33.583782 2021] [mpm_prefork:error] [pid 26982] AH00161: server reached MaxRequestWorkers setting, consider raising the MaxRequestWorkers setting
[Sat Apr 03 14:29:21.909309 2021] [mpm_prefork:error] [pid 9887] AH00161: server reached MaxRequestWorkers setting, consider raising the MaxRequestWorkers setting
From there, you may check the timestamps of your notifications to see if they're occurring around the same times:
[root]cPs# ls -l /var/cpanel/user_notifications/root/history/ | grep FAIL | tail -n2
-rw-r--r--. 1 root root 47K Apr 2 13:35 1617350713_chkservd___[host.name.com] FAILED ⛔: httpd (x.x.x.x).eml
-rw-r--r--. 1 root root 47K Apr 3 14:45 1617441310_chkservd___[host.name.com] FAILED ⛔: httpd (x.x.x.x).eml
If the notification timestamps are closely following the timestamps for MaxRequestWorkers being hit, this may cause the error message.
Workaround
If MaxRequstWOrkers being hit has been determined to cause Apache to appear down, and there doesn't seem to be a DDOS occurring, you may consider raising the setting and/or further tuning Apache to your server's needs per our support article: Tuning MaxRequestWorkers for Apache.