I am hosting a small testing website with Apache running on Linux, using free EC2 Micro instance.
When I tried to look at background process with "top", I saw a lot of (30+) "apache" user
PID user PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
12104 apache 20 0 429m 9024 2420 S 1.0 0.2 0:02.91 httpd
12273 apache 20 0 429m 9108 2504 S 1.0 0.2 0:01.20 httpd
...
I am not sure this is normal. Does this mean I may be attached by someone/virus?
P.S. I only expect 2-3 test users to use it at all at this point. It's a php + apache + mysql architect.
thanks.
Apache httpd always tries to maintain several spare or idle server processes, which stand ready to serve incoming requests. In this way, clients do not need to wait for a new child processes to be forked before their requests can be served.
Apache will pre-create worker processes so, when a load spike comes in, the processes can pick up the requests immediately, instead of waiting for the master to spawn enough of them. Check your httpd.conf for MinSpareServers, MaxSpareServers and ServerLimit.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With