Apache service randomly stopping

If you're apache server somehow stops working randomly, first thing you can do is to check Apache error logs.

[Mon May 24 15:39:26.328479 2021] [php7:error] [pid 3203] [client 52.65.15.196:9267] script '/var/www/html/wp-login.php' not found or unable to stat
[Mon May 24 15:39:26.852814 2021] [php7:error] [pid 7809] [client 52.65.15.196:31930] script '/var/www/html/wp-login.php' not found or unable to stat
[Mon May 24 15:42:15.348017 2021] [php7:error] [pid 6091] [client 52.192.73.251:59992] script '/var/www/html/wp-login.php' not found or unable to stat
[Mon May 24 15:42:18.382698 2021] [php7:error] [pid 6263] [client 52.192.73.251:20394] script '/var/www/html/wp-login.php' not found or unable to stat
[Mon May 24 15:51:41.982574 2021] [php7:error] [pid 4420] [client 3.8.12.221:32028] script '/var/www/html/wp-login.php' not found or unable to stat
[Mon May 24 15:51:42.243716 2021] [php7:error] [pid 15790] [client 3.8.12.221:39625] script '/var/www/html/wp-login.php' not found or unable to stat

For my case, the logs above are so suspicious because I don't even run a Wordpress site. So it feels like something or someone is trying to brute force attack my server.

If you have notice something similar, one thing you can do is to install Fail2ban.

 

Installing in Ubuntu 16.04

apt-get install fail2ban

then copy jail.conf to jail.local

cd /etc/fail2ban
cp jail.conf jail.local

edit jail.local and search for "apache-noscript"

[apache-noscript]
enabled=true

then restart the fail2ban service to reload the configurations

service fail2ban restart

to check the status like the ip addresses that were banned and some statistics, run

fail2ban-client status apache-noscript