Topic: Strange Apache shutdown

[msem]

Hi everybody
I have a strange problem with Apache 2.2.3
We distribute Apache as front end of our application, apache is handled by a servermanager service application written by ourself.
Apache is not installed as service, instead our servermanager spawn the apache process and handle the apache output and shutdown. like running apache interactively in a DOS box.

One of our customer connect to the server every day to schedule a backup job with brightmail arcserve, 98% of the times he connects to the server apache graceful shutdown itself, like apache receives a CTRL+C

From the apache event log
[Fri Mar 13 17:07:03 2009] [notice] Parent: Received shutdown signal -- Shutting down the server.
[Fri Mar 13 17:07:03 2009] [notice] Child 1464: Exit event signaled. Child process is ending.
[Fri Mar 13 17:07:04 2009] [notice] Child 1464: Released the start mutex
[Fri Mar 13 17:07:05 2009] [notice] Child 1464: Waiting for 50 worker threads to exit.
[Fri Mar 13 17:07:05 2009] [notice] Child 1464: All worker threads have exited.
[Fri Mar 13 17:07:05 2009] [notice] Child 1464: Child process is exiting
[Fri Mar 13 17:07:05 2009] [notice] Parent: Child process exited successfully.
Apache server shutdown initiated...

from the application event log
13/03/2009,17.07.13,Userenv,Information,None,1516,NT AUTHORITY\SYSTEM,MIL-FS02,Windows unloaded user S-1-5-21-602162358-1897051121-1417001333-15420_Classes registry when it received a notification that no other applications or services were using the profile.
13/03/2009,17.07.11,Userenv,Warning,None,1524,ADS\angelo digianni,MIL-FS02,"Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.

I don't know why arcserve job could shutdown apache, but the evidence from the apache error log and the user action are a smoking gun.

Anyone experienced something like this?

Thanks

[James Blond]

Which url is the customer requesting when apache shutsdown? is it a single script / page or different URLs? What is at that time in the access.log ?