I run apache 2.2.9 with mpm prefork on debian lenny. Following http://httpd.apache.org/docs/2.2/mod/prefork.html, I would expect that there is one parent process, running as root and listening as configured, which would start child processes as defined by the Min/Max/etc. directives. I expect the children to be restarted as per MaxRequestsPerChild, but the parent process to stay put with one process id until I restart it manually.

Out of a little paranoia, I started monitoring listening ports including process ids. I have a cron job every 20 minutes to run netstat -ap | grep LISTEN and diff the output. Sometimes (about once per day) I see a series of this:

8c8
< tcp6       0      0 [::]:www                [::]:*                  LISTEN      6194/apache2    
---
tcp6       0      0 [::]:www                [::]:*                  LISTEN      6607/apache2    
10c10
< tcp6       0      0 [::]:https              [::]:*                  LISTEN      6194/apache2    
---
tcp6       0      0 [::]:https              [::]:*                  LISTEN      6607/apache2

Over a period of an hour or three, the parent would change its pid at least once every 20 minutes, without any explanation in the log files or any other hint that anything is going wrong.

This is not what I expected. What am I missing?