I just noticed that on one server /var/log/httpd/error_log has a lot of 'zend_mm_heap corrupted' entries. OSSEC apparently doesn't pick these up. Pages load normally though. Is there a problem to solve here?

Installed PHP packages:



Don't know if this is related, but this is also the one server where installing php-eaccelerator causes Apache to segfault, while it works fine on all of our other servers.

It seems like a code related error to me that mostly happens in heavy code.
I have searched a little bit.
Maybe you can try this to near it down:

or try to change one of these variables in php.ini. best would be on the domain that is causing the crash.
I assume to the other post that you are using suPHP.

(That would be /usr/sbin/apachectl on CentOS.) I just googled USE_ZEND_ALLOC and read it doesn't do much when using mod_php.



The 'zend_mm_heap corrupted' messages appear in the global /var/log/httpd/error_log, so not in a specific domain's error_log.



No, this is just plain old mod_php.



EGPCS is the default. Why do you recommend not registering environment variables?



These settings are both set to off.

those where just options to isolate the problem.
After reading your answers it seems not so easy to near down.
Do these errors show up constantly or only during day or night time?

I'm not sure as there are no timestamps with the 'zend_mm_heap corrupted' messages. I also noticed Apache segfaults ~20 times a day (no eAccelerator installed). I also noticed a bunch of apache owned semaphores hanging around after stopping Apache. I cleaned those up, let's see if that makes a difference.

It could be Horde related. If a user access horde webmail interface and want to read/open bigger emails.
Do you have users leaving there mail on the server and using horde?
Maybe you can create a dummy mail account and put some big messages(with big embedded pictures e.g.) in an extra created imap folder other than inbox
and then try out horde. After reading a few messages the error could show up.

this case seems pretty tricky. maybe you could gdb the whole processes to near it down.

Trying to open e-mails with large attachments result in out of memory errors when PHP's memory_limit is reached. I know those, but those are nice clean error messages, with timestamps and references to Horde and everything.

Thanks for the help though.

Hm, that wasn't it. Just got another 'zend_mm_heap corrupted' in /var/log/httpd/error_log.

When it comes to the mod_sec-related segfaults, I find that NOT cleaning up the semaphores helps.

i.e. get segfaults, see semaphores increase slightly, restart apache (service httpd restart) without cleaning semaphores = no more segfaults. In contrast, cleaning the semaphores quite often results in segfaults again.

This isn't mod_sec related, and not segfault-related either, but I thought I'd mention it anyway!

Have you run a memory check/checked hardware log for any bit errors? Just in case?