Apache webserver outage - need help with forensics

[Bob Brennan]

On 4/13/05, Kristina Clair <kclair at gmail.com> wrote:
> On 4/13/05, Bob Brennan <rbrennan96 at gmail.com> wrote:
> > On 4/13/05, Kristina Clair <kclair at gmail.com> wrote:
> > > Did you do a traceroute or any other network diagnostic to make sure
> > > that you were actually able to reach the server?  It sounds like a
> > > networking problem...
> > >
> > > Kristina
> >
> > Hi Kristina - FTP and mailserver (the only other 2 open services) were
> > responding quickly and correctly throughout the outage - all running
> > on the same machine.
> >
> 
> Hmmm.  I was confused about this point:
> * all access_log and error_log for all sites - showed 5 users using
> the sites at the time but nothing unusual
> 
> Did you mean that 5 users were using the sites right before it became
> inaccessible, or that there were people actually using the site when
> you couldn't reach it?

There were log entries on several of my virtual domains right up to
the minute that the webserver became unresponsive - at least 5
separate IP addresses at the time. I noticed the problem when
Squirrelmail timed out on a refresh. There are no log entries on any
of the sites for the next 20 minutes.
 
> Also, did you check all the domains that apache is configured to serve?

Yes I checked all domains, including the IP address itself. Even
"telnet myserver.net 80" would not connect. "telnet myserver.net 21"
and 25 responded as expected.