Recently a few of my Linodes (all running WordPress sites on Ubuntu 12.04) have been having some issues with OOMing resulting in sites showing "Error establishing a database connection" until I reboot. MySQL and Apache settings are currently based on the information in the Getting Started guides on Linode for a 1GB Linode.

Here's an example of recent information regarding the OOM:

Out of memory: Kill process 17714 (apache2) score 45 or sacrifice child
Killed process 17714 (apache2) total-vm:349776kB, anon-rss:41900kB, file-rss:0kB
Out of memory: Kill process 17719 (apache2) score 46 or sacrifice child
Killed process 17719 (apache2) total-vm:350308kB, anon-rss:38544kB, file-rss:720kB

I've already started going through this guide but haven't had much luck getting the issue resolved. For the time being I'm using cron to reboot the problem servers every two hours, but this is of course far from ideal.

I'd like to figure out exactly what is causing the OOMing and make any necessary adjustments, but don't really know where to begin since I'm still pretty new to working with VPS servers/Linux.

Any help is greatly appreciated!

Look in your Apache domain logs. You'll probably find a lot of POST requests to xmlrpc.php. If that's the case, you'll need to restrict access to it.

Here are my most recent Apache logs.

error.log

[Sun Jan 18 06:30:45 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch configured -- resuming normal operations
[Sun Jan 18 14:05:46 2015] [notice] caught SIGTERM, shutting down
[Sun Jan 18 14:07:40 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch configured -- resuming normal operations
Program mode requires special privileges, e.g., root or TrustedUser.
Program mode requires special privileges, e.g., root or TrustedUser.
Program mode requires special privileges, e.g., root or TrustedUser.
Program mode requires special privileges, e.g., root or TrustedUser.
Program mode requires special privileges, e.g., root or TrustedUser.
Program mode requires special privileges, e.g., root or TrustedUser.
Program mode requires special privileges, e.g., root or TrustedUser.
[Mon Jan 19 15:24:14 2015] [notice] caught SIGTERM, shutting down
[Mon Jan 19 15:24:15 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch configured -- resuming normal operations
[Sat Jan 24 10:20:02 2015] [error] server reached MaxClients setting, consider raising the MaxClients setting
[Sat Jan 24 10:20:39 2015] [error] (12)Cannot allocate memory: fork: Unable to fork new process
[Sat Jan 24 10:20:51 2015] [error] (12)Cannot allocate memory: fork: Unable to fork new process
[Sat Jan 24 10:21:03 2015] [error] (12)Cannot allocate memory: fork: Unable to fork new process
[Sun Jan 25 06:26:43 2015] [notice] Graceful restart requested, doing restart
[Sun Jan 25 06:26:44 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch configured -- resuming normal operations
[Sun Jan 25 13:06:34 2015] [notice] caught SIGTERM, shutting down
[Sun Jan 25 13:07:04 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch configured -- resuming normal operations
[Mon Jan 26 15:27:09 2015] [notice] caught SIGTERM, shutting down
[Mon Jan 26 15:27:10 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Mon Jan 26 15:35:57 2015] [error] [client 2607:fb90:2506:5824:b829:c96c:88b5:4d69] Invalid method in request \x16\x03\x01
[Mon Jan 26 15:35:57 2015] [error] [client 2607:fb90:2506:5824:b829:c96c:88b5:4d69] Invalid method in request \x16\x03\x01
[Mon Jan 26 15:43:20 2015] [error] [client 207.112.104.55] Invalid method in request \x16\x03\x01
[Mon Jan 26 16:23:48 2015] [error] [client 70.116.159.64] Invalid method in request \x16\x03\x01
[Mon Jan 26 16:23:48 2015] [error] [client 70.116.159.64] Invalid method in request \x16\x03\x01
[Mon Jan 26 16:23:48 2015] [error] [client 70.116.159.64] Invalid method in request \x16\x03\x01
[Mon Jan 26 18:10:32 2015] [notice] caught SIGTERM, shutting down
[Mon Jan 26 18:10:32 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Tue Jan 27 06:35:59 2015] [notice] Graceful restart requested, doing restart
[Tue Jan 27 06:35:59 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Tue Jan 27 12:33:42 2015] [error] (12)Cannot allocate memory: fork: Unable to fork new process
[Tue Jan 27 12:47:42 2015] [notice] caught SIGTERM, shutting down
[Tue Jan 27 12:48:12 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Tue Jan 27 13:35:22 2015] [error] [client 2601:1:bf80:3b1:6d07:9847:a6f:5db9] Invalid method in request \x16\x03\x01
[Tue Jan 27 13:35:22 2015] [error] [client 2601:1:bf80:3b1:6d07:9847:a6f:5db9] Invalid method in request \x16\x03\x01
[Tue Jan 27 13:35:22 2015] [error] [client 2601:1:bf80:3b1:6d07:9847:a6f:5db9] Invalid method in request \x16\x03\x01
[Tue Jan 27 13:49:28 2015] [error] [client 2601:1:bf80:3b1:6d07:9847:a6f:5db9] Invalid method in request \x16\x03\x01
[Tue Jan 27 13:49:28 2015] [error] [client 2601:1:bf80:3b1:6d07:9847:a6f:5db9] Invalid method in request \x16\x03\x01
[Tue Jan 27 13:49:28 2015] [error] [client 2601:1:bf80:3b1:6d07:9847:a6f:5db9] Invalid method in request \x16\x03\x01
[Tue Jan 27 14:36:17 2015] [error] [client 2601:d:2a80:100e:4d33:d483:7ddf:2c74] Invalid method in request \x16\x03\x01
[Tue Jan 27 14:36:17 2015] [error] [client 2601:d:2a80:100e:4d33:d483:7ddf:2c74] Invalid method in request \x16\x03\x01
[Tue Jan 27 14:36:17 2015] [error] [client 2601:d:2a80:100e:4d33:d483:7ddf:2c74] Invalid method in request \x16\x03
[Tue Jan 27 14:36:20 2015] [error] [client 2601:d:2a80:100e:4d33:d483:7ddf:2c74] Invalid method in request \x16\x03\x01
[Tue Jan 27 14:36:20 2015] [error] [client 2601:d:2a80:100e:4d33:d483:7ddf:2c74] Invalid method in request \x16\x03\x01
[Tue Jan 27 14:36:20 2015] [error] [client 2601:d:2a80:100e:4d33:d483:7ddf:2c74] Invalid method in request \x16\x03\x01
[Tue Jan 27 14:36:20 2015] [error] [client 2601:d:2a80:100e:4d33:d483:7ddf:2c74] Invalid method in request \x16\x03
[Tue Jan 27 15:03:35 2015] [error] [client 2601:d:ad00:8620:11b5:e111:b637:9d5e] Invalid method in request \x16\x03\x01
[Tue Jan 27 15:03:35 2015] [error] [client 2601:d:ad00:8620:11b5:e111:b637:9d5e] Invalid method in request \x16\x03\x01
[Tue Jan 27 15:03:35 2015] [error] [client 2601:d:ad00:8620:11b5:e111:b637:9d5e] Invalid method in request \x16\x03
[Tue Jan 27 16:18:50 2015] [notice] caught SIGTERM, shutting down
[Tue Jan 27 16:18:51 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Tue Jan 27 17:05:47 2015] [notice] caught SIGTERM, shutting down
[Tue Jan 27 17:07:32 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Tue Jan 27 18:05:03 2015] [notice] caught SIGTERM, shutting down
[Tue Jan 27 18:06:48 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Tue Jan 27 19:05:03 2015] [notice] caught SIGTERM, shutting down
[Tue Jan 27 19:06:18 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Tue Jan 27 20:05:03 2015] [notice] caught SIGTERM, shutting down
[Tue Jan 27 20:06:41 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Tue Jan 27 20:23:06 2015] [error] [client 2601:d:2a80:100e:ed61:dc3e:f885:c2a6] Invalid method in request \x16\x03\x01
[Tue Jan 27 20:23:06 2015] [error] [client 2601:d:2a80:100e:ed61:dc3e:f885:c2a6] Invalid method in request \x16\x03\x01
[Tue Jan 27 20:23:06 2015] [error] [client 2601:d:2a80:100e:ed61:dc3e:f885:c2a6] Invalid method in request \x16\x03\x01
[Tue Jan 27 20:23:06 2015] [error] [client 2601:d:2a80:100e:ed61:dc3e:f885:c2a6] Invalid method in request \x16\x03\x01
[Tue Jan 27 20:23:06 2015] [error] [client 2601:d:2a80:100e:ed61:dc3e:f885:c2a6] Invalid method in request \x16\x03
[Tue Jan 27 21:05:03 2015] [notice] caught SIGTERM, shutting down
[Tue Jan 27 21:06:09 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Tue Jan 27 22:05:02 2015] [notice] caught SIGTERM, shutting down
[Tue Jan 27 22:06:48 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Tue Jan 27 23:05:03 2015] [notice] caught SIGTERM, shutting down
[Tue Jan 27 23:06:56 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 00:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 00:06:25 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 01:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 01:06:09 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 02:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 02:06:14 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 03:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 03:06:46 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 04:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 04:06:35 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 05:05:01 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 05:06:40 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 06:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 06:05:52 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 07:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 07:06:07 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 08:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 08:06:42 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 09:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 09:06:07 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 10:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 10:07:01 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 11:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 11:06:29 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 12:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 12:07:11 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 12:23:36 2015] [error] [client 2601:c:3200:453:459c:b73d:cb20:9df9] Invalid method in request \x16\x03\x01
[Wed Jan 28 12:23:36 2015] [error] [client 2601:c:3200:453:459c:b73d:cb20:9df9] Invalid method in request \x16\x03
[Wed Jan 28 13:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 13:06:34 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 14:05:02 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 14:07:06 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 15:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 15:06:23 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 15:32:13 2015] [error] [client 2601:6:6a80:c116:b538:96b6:dd03:a82f] Invalid method in request \x16\x03\x01
[Wed Jan 28 15:34:27 2015] [error] [client 2601:6:6a80:c116:b538:96b6:dd03:a82f] Invalid method in request \x16\x03\x01
[Wed Jan 28 15:34:27 2015] [error] [client 2601:6:6a80:c116:b538:96b6:dd03:a82f] Invalid method in request \x16\x03\x01
[Wed Jan 28 15:36:11 2015] [error] [client 2601:6:6a80:c116:b538:96b6:dd03:a82f] Invalid method in request \x16\x03\x01
[Wed Jan 28 15:36:12 2015] [error] [client 2601:6:6a80:c116:b538:96b6:dd03:a82f] Invalid method in request \x16\x03\x01
[Wed Jan 28 16:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 16:06:02 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 17:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 17:06:10 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 17:53:22 2015] [error] (12)Cannot allocate memory: fork: Unable to fork new process
[Wed Jan 28 17:53:38 2015] [error] (12)Cannot allocate memory: fork: Unable to fork new process
[Wed Jan 28 17:53:48 2015] [error] (12)Cannot allocate memory: fork: Unable to fork new process
[Wed Jan 28 17:54:01 2015] [error] (12)Cannot allocate memory: fork: Unable to fork new process
[Wed Jan 28 17:54:11 2015] [error] (12)Cannot allocate memory: fork: Unable to fork new process
[Wed Jan 28 17:54:21 2015] [error] (12)Cannot allocate memory: fork: Unable to fork new process
[Wed Jan 28 18:05:02 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 18:06:58 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 19:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 19:06:37 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 20:05:02 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 20:06:05 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 21:05:04 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 21:06:33 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 21:34:21 2015] [error] [client 2602:304:b202:7ae0:595:fb80:3857:34ec] Invalid method in request \x16\x03\x01
[Wed Jan 28 21:34:21 2015] [error] [client 2602:304:b202:7ae0:595:fb80:3857:34ec] Invalid method in request \x16\x03\x01
[Wed Jan 28 21:34:22 2015] [error] [client 2602:304:b202:7ae0:595:fb80:3857:34ec] Invalid method in request \x16\x03\x01
[Wed Jan 28 21:34:38 2015] [error] [client 2602:304:b202:7ae0:595:fb80:3857:34ec] Invalid method in request \x16\x03\x01
[Wed Jan 28 21:34:38 2015] [error] [client 2602:304:b202:7ae0:595:fb80:3857:34ec] Invalid method in request \x16\x03\x01
[Wed Jan 28 21:34:38 2015] [error] [client 2602:304:b202:7ae0:595:fb80:3857:34ec] Invalid method in request \x16\x03\x01
[Wed Jan 28 22:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 22:06:49 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 23:05:03 2015] [notice] caught SIGTERM, shutting down
[Wed Jan 28 23:06:04 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Wed Jan 28 23:16:46 2015] [error] [client 2600:3c00::f03c:91ff:fe89:a066] Invalid method in request \x16\x03\x01
[Thu Jan 29 00:05:03 2015] [notice] caught SIGTERM, shutting down
[Thu Jan 29 00:06:33 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Thu Jan 29 01:05:03 2015] [notice] caught SIGTERM, shutting down
[Thu Jan 29 01:06:40 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Thu Jan 29 02:05:03 2015] [notice] caught SIGTERM, shutting down
[Thu Jan 29 02:06:29 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Thu Jan 29 02:31:21 2015] [error] [client 2602:306:3095:9ef0:1503:5026:35dd:d44a] Invalid method in request \x16\x03\x01
[Thu Jan 29 02:31:21 2015] [error] [client 2602:306:3095:9ef0:1503:5026:35dd:d44a] Invalid method in request \x16\x03\x01
[Thu Jan 29 02:31:21 2015] [error] [client 2602:306:3095:9ef0:1503:5026:35dd:d44a] Invalid method in request \x16\x03\x01
[Thu Jan 29 02:31:21 2015] [error] [client 2602:306:3095:9ef0:1503:5026:35dd:d44a] Invalid method in request \x16\x03\x01
[Thu Jan 29 03:05:03 2015] [notice] caught SIGTERM, shutting down
[Thu Jan 29 03:06:05 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Thu Jan 29 04:05:03 2015] [notice] caught SIGTERM, shutting down
[Thu Jan 29 04:07:11 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Thu Jan 29 05:05:03 2015] [notice] caught SIGTERM, shutting down
[Thu Jan 29 05:05:59 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Thu Jan 29 06:05:02 2015] [notice] caught SIGTERM, shutting down
[Thu Jan 29 06:07:18 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Thu Jan 29 07:05:03 2015] [notice] caught SIGTERM, shutting down
[Thu Jan 29 07:06:10 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Thu Jan 29 08:05:04 2015] [notice] caught SIGTERM, shutting down
[Thu Jan 29 08:06:14 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Thu Jan 29 08:08:29 2015] [error] [client 2001:4802:7800:1:be76:4eff:fe20:c2d0] Invalid method in request \x16\x03\x01
[Thu Jan 29 09:05:04 2015] [notice] caught SIGTERM, shutting down
[Thu Jan 29 09:06:02 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Thu Jan 29 10:05:03 2015] [notice] caught SIGTERM, shutting down
[Thu Jan 29 10:06:15 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
[Thu Jan 29 10:49:54 2015] [notice] caught SIGTERM, shutting down
[Thu Jan 29 10:49:55 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.15 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations

other_vhosts_access.log excerpt

asimov.sensoryworld.com:80 2602:304:b202:7ae0:595:fb80:3857:34ec - - [28/Jan/2015:21:34:21 -0500] "\x16\x03\x01" 501 294 "-" "-"
asimov.sensoryworld.com:80 2602:304:b202:7ae0:595:fb80:3857:34ec - - [28/Jan/2015:21:34:21 -0500] "\x16\x03\x01" 501 294 "-" "-"
asimov.sensoryworld.com:80 2602:304:b202:7ae0:595:fb80:3857:34ec - - [28/Jan/2015:21:34:22 -0500] "\x16\x03\x01" 501 294 "-" "-"
asimov.sensoryworld.com:80 2602:304:b202:7ae0:595:fb80:3857:34ec - - [28/Jan/2015:21:34:38 -0500] "\x16\x03\x01" 501 294 "-" "-"
asimov.sensoryworld.com:80 2602:304:b202:7ae0:595:fb80:3857:34ec - - [28/Jan/2015:21:34:38 -0500] "\x16\x03\x01" 501 294 "-" "-"
asimov.sensoryworld.com:80 2602:304:b202:7ae0:595:fb80:3857:34ec - - [28/Jan/2015:21:34:38 -0500] "\x16\x03\x01" 501 294 "-" "-"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:21:34:42 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:21:34:43 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:21:34:44 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:21:36:32 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:21:37:59 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:16:44 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:16:45 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:16:57 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:16:58 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:20:25 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:40:37 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:40:38 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:40:39 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:40:40 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:40:41 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:42:07 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:42:08 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:42:09 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:42:27 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:42:28 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:42:29 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:42:30 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:42:31 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:42:32 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:22:42:33 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:23:06:33 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:23:06:37 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 2600:3c00::f03c:91ff:fe89:a066 - - [28/Jan/2015:23:16:46 -0500] "\x16\x03\x01" 501 294 "-" "-"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:23:22:40 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:23:22:41 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:23:54:36 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [28/Jan/2015:23:57:28 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:01:56:37 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:01:56:38 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:01:56:39 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 2602:306:3095:9ef0:1503:5026:35dd:d44a - - [29/Jan/2015:02:31:21 -0500] "\x16\x03\x01" 501 294 "-" "-"
asimov.sensoryworld.com:80 2602:306:3095:9ef0:1503:5026:35dd:d44a - - [29/Jan/2015:02:31:21 -0500] "\x16\x03\x01" 501 294 "-" "-"
asimov.sensoryworld.com:80 2602:306:3095:9ef0:1503:5026:35dd:d44a - - [29/Jan/2015:02:31:21 -0500] "\x16\x03\x01" 501 294 "-" "-"
asimov.sensoryworld.com:80 2602:306:3095:9ef0:1503:5026:35dd:d44a - - [29/Jan/2015:02:31:21 -0500] "\x16\x03\x01" 501 294 "-" "-"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:02:42:47 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:02:54:10 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:03:57:06 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:04:00:18 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:04:08:09 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:04:08:10 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:04:08:11 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:04:08:12 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:05:11:28 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:05:11:29 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:05:11:30 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:05:11:31 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:05:11:32 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:06:44:17 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:06:44:18 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:06:44:19 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:06:52:47 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:07:14:03 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:07:14:04 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:07:14:09 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:07:14:10 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:07:14:11 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:07:14:12 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:07:14:13 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:07:44:54 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:07:53:31 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 2001:4802:7800:1:be76:4eff:fe20:c2d0 - - [29/Jan/2015:08:08:29 -0500] "\x16\x03\x01" 501 294 "-" "-"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:08:08:52 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:08:33:15 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:08:33:16 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:08:39:36 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
asimov.sensoryworld.com:80 ::1 - - [29/Jan/2015:10:29:36 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"

I went ahead and made a change to the MaxClients setting already hoping that will make a difference, but I'm not sure I can gather much else about the problem from these with my current level of expertise.

I went ahead and restricted access to xmlrpc.php, upgraded the Linode to a 2048 account and changed the Apache, MySQL, and PHP settings to match Linode's recommendations for this type of account but I'm still having issues with OOMing. Sometimes I can't even SSH into the server or connect via SFTP because of the memory issues. Just keeping the site online is becoming a problem.

Where else might I try looking to diagnose the issue and get it under control quickly?

What did you drop MaxClients to? It seems most likely that you're simply letting too many connections run simultaneously for your memory resources. The guides are estimates, but they can't necessarily account for exactly how much resource you need for each individual request.

So start by seeing roughly how much memory you have free with all your usual daemons running but not yet servicing any web requests. Then determine roughly how large a single request is (between any apache or php processes used) and that should get you in the ball park for how many simultaneous clients you can support, sans whatever database growth you'll have.

When it doubt, hit it with a sledge hammer. Drop MaxClients like a rock (say 1-5) and then watch and see how your memory usage goes, then slowly increase clients while you still have available memory. Your latency may suffer, but at this point you want to stop the pain, and slower responses are generally better than the no response you get once you've gone over the cliff.

This assumes that there isn't a bug somewhere in your request handling that is going to exhaust memory even if it's the only request running on the system, but if that's the case it'll be easier to see if you don't have 20 or 30 requests running simultaneously.

If you find out that the maximum clients you can support is far lower than you estimated, then try to figure out why and where the resources are going, but at least you'll be operational while doing that. You might also start optimizing by shifting simple static requests away from a high cost path (making sure that you're letting Apache handle static resources directly and not passing a request for a jpg off to WP). Or even fronting the whole system with something else to offload static assets. But all of that can follow stabilizing things first.

-- David

Note to OP: Apache's error messages are ridiculously misleading. It tells you to "consider raising the MaxClients setting", when what you really need to do is the exact opposite. This is a well-known issue with Apache/mpm_prefork/mod_php going back at least a decade. Drop that setting, drop it hard, drop it like it's hot coal that you'd just picked up with your bare hands. For a Linode 2048, the optimum is probably around 10±5, provided that you also drop KeepAlive to something like 1~3.

I still have no idea why Linux distributions keep insisting on shipping Apache with an insanely high default value for MaxClients after all these years, when it's so easy to change the default just for mpm_prefork.