Every new request to a web app will cause a Semaphore to be created... the problem is that it does not release the created semaphore. I have tried just about every combination of option suggested and none kills the semephore created.

 

This is how I resolved the issue.

Eventually you will get this error in your /var/log/httpd/error_log:

[crit] (28)No space left on device: Failed to create mutex

Restarting apache will not kill these either!

First check your Semaphore Settings:

ipcs -ls

------ Semaphore Limits --------
max number of arrays = 128
max semaphores per array = 250
max semaphores system wide = 32000
max ops per semop call = 250
semaphore max value = 32767

!!NOTE!!  Make sure that this calculation below is always true:

max number of arrays * max semaphores per array = max semaphores system wide.

When the number of Semaphores reaches the "max semaphores per array" you will get the above mentioned error.

Here is my resolution:

1.  Increase "max semaphores per array" so the error happens less :

echo "kernel.sem=250 32000 250 128" >> /etc/sysctl.conf

2.  Update the /etc/init.d/httpd so a simple restart of Apache will kill the stray Semaphores:

add this to the begining of the Start()  process:

ipcs|grep apache|awk '{print $2}'|xargs -I {} ipcrm -s {};

3.  Use OSSEC to restart Apache

First Create a command in ossec.conf

nano /var/ossec/etc/ossec.conf

<!-- START Charles van den akker III custom commands-->
<command>
  <name>apache-restart</name>
  <executable>apache-restart.sh</executable>
  <expect></expect>
  <timeout_allowed>no</timeout_allowed>
</command>
<!-- END  Charles van den akker III custom commands-->

as well as an Active-Response

<!-- START Charles van den akker III custom Active Response-->
<active-response>
  <command>apache-restart</command>
  <location>server</location>
  <rules_id>100051</rules_id>
</active-response>
<!-- END Charles van den akker III custom Active Response-->

Open local_rules.xml

nano /var/ossec/rules/local_rules.xml

<rule id="100051" level="6">
<if_sid>1007</if_sid>
<match>[crit] (28)No space left on device: Failed to create mutex</match>
  <description>Apache Semaphore limit reached. Apache Restarted</description>
  <group>low_diskspace,</group>
</rule>
</group>

This is rule 1007 in syslog_rules.xml:

  <rule id="1007" level="7">
    <match>file system full|No space left on device</match>
    <description>File system full.</description>
    <group>low_diskspace,</group>
  </rule>

Create apache-restart.sh

nano /var/ossec/active-response/bin/apache-restart.sh

 

#!/bin/sh
# Restarts Apache.
# Requirements: none
# Author: Charles van den akker III

ACTION=$1
USER=$2
IP=$3
ALERTID=$4
RULEID=$5


LOCAL=`dirname $0`;
cd $LOCAL
cd ../
PWD=`pwd`

# Logging the call
echo "`date` $0 $1 $2 $3 $4 $5 $6 $7 $8" >> ${PWD}/../logs/apacherestarts.log


# Restart Apache
if [ "x${ACTION}" = "xadd" ]; then
   /etc/init.d/httpd restart
   exit 0;


# Invalid action
else
   echo "$0: invalid action: ${ACTION}"
fi

exit 1;

Set File Premissions

chown root:ossec /var/ossec/active-response/bin/apache-restart.sh;
chmod 755 /var/ossec/active-response/bin/apache-restart.sh;

Create logfile for apacherestarts:

echo "[START]" >> /var/ossec/logs/apacherestarts.log;
chown ossec:ossec /var/ossec/logs/apacherestarts.log;
chmod 750 /var/ossec/logs/apacherestarts.log;

 

Restart Ossec:

/var/ossec/bin/ossec-control restart

run a test:

logger "[crit] (28)No space left on device: Failed to create mutex '/tmp/mod_mono/whatever";tail -f /var/log/httpd/error_log;

 

you should see apache restarting.