httpd start timestamp

can you tell me, why are last three httpd processes started at different time then others?

also, why is process owner different?

[root@myserver httpd]# ps aux | grep httpd
root      5455  0.0  0.6 31980 13028 ?       S    11:19   0:00 /usr/sbin/httpd
apache    5475  0.0  0.1 22704 4076 ?        S    11:19   0:00 /usr/sbin/httpd
apache    5513  0.0  1.1 44504 23912 ?       S    11:19   0:04 /usr/sbin/httpd
apache    5514  0.0  1.1 44524 23964 ?       S    11:19   0:05 /usr/sbin/httpd
apache    5515  0.0  1.1 44524 23752 ?       S    11:19   0:05 /usr/sbin/httpd
apache    5516  0.0  1.1 44484 23640 ?       S    11:19   0:05 /usr/sbin/httpd
apache    5517  0.0  1.1 44528 23340 ?       S    11:19   0:05 /usr/sbin/httpd
apache    5518  0.0  1.1 44504 23500 ?       S    11:19   0:04 /usr/sbin/httpd
apache    5519  0.0  1.1 44508 23744 ?       S    11:19   0:04 /usr/sbin/httpd
apache    5520  0.0  1.1 44668 23972 ?       S    11:19   0:05 /usr/sbin/httpd
apache    6149  0.0  1.1 44412 23420 ?       S    11:20   0:06 /usr/sbin/httpd
apache    6769  0.0  1.1 44504 23528 ?       S    11:30   0:04 /usr/sbin/httpd
apache    7357  0.0  1.1 44500 23408 ?       S    12:01   0:03 /usr/sbin/httpd
apache    7395  0.0  1.1 44428 23636 ?       S    12:04   0:03 /usr/sbin/httpd
root      7949  0.0  0.0  3912  672 pts/0    S    19:54   0:00 grep httpd
[root@myserver httpd]# 

thank you in advance!

From serverfault

• If you're using the standard pre-fork MPM module of Apache (which appears that you do), it will fork off new processes if all other processes are busy. You should have a section in your Apache conf that looks like this:

  <IfModule prefork.c>
  StartServers       8
  MinSpareServers    5
  MaxSpareServers   20
  ServerLimit      256
  MaxClients       256
  MaxRequestsPerChild  4000
  </IfModule>
  

  This says to start off with 8 processes, and allow up to 256 processes to be forked. Those last few processes are a result of this.

  Zoredache : Another important point is the `MaxRequestsPerChild` option. This will automatically kill off child processes after a certain number of requests as a way to combat memory leaks. So it is also possible those process had lived out their lifetime and had been killed and recreated.

  : several times in last few days i had a lot of new httpd processes, that every time i had to restart my box. on log files i did not notice activity different then before. what can be the cause? flooding? or something in server?

  vmfarms : It usually spawns new processes depending on the number of requests? Are you certain that logs don't show an increase in traffic? You could try performing a `tcpdump` on port 80 to see what kind of traffic you're seeing.

  : will tcpdump -i eth1 'port 80' be ok to catch?

  vmfarms : Yes, if `eth1` is your primary interface which you receive HTTP traffic on. You should also throw in a `-n` to prevent DNS resolution (makes it a little faster).
  From vmfarms