Re: [cobalt-security] urgent question

["Gareth" <garth@xxxxxxxxxxxxxxx>]

Not too sure what the problem is, but when you did the kills did you try:
kill -9 pid
which usually kills processes quite well. Sometimes when you just send a
process the
usual kill command it will try and quit nicely, sometimes wait to finish
what it is doing.
Using the -9 kinda hurries things up a bit by really killing the process (I
beleive -9 sends
the process a bus error).
As to what went wrong, check the logs as suggested above, is it possible a
cgi-script
started printing to STDERR?
Gareth

> From: "Kai r. s., euroweb as" <kai@xxxxxxxxxx>
> To: "cobalt security list" <cobalt-security@xxxxxxxxxxxxxxx>
> Date: Wed, 19 Sep 2001 02:25:37 +0200
> Subject: [cobalt-security] urgent question
> Reply-To: cobalt-security@xxxxxxxxxxxxxxx
>
> Hi, I have a rather urgent question.
>
> Today my raq3i server sent a alert massage that it was having very high
cpu
> usage. I ran "top" and there it was 4-5 httpd ps (/usr/sbin/httpd -f
> /etc/httpd/conf/httpd.confthat) where using all cpu, and some of them had
> been running for 3-4h. I tryed to stop the prosesses with kill pid, but
they
> would not go down. I needed to stop the webserver to kill them.
>
> I am now serhing for the reasson for this (tips needed), maybe it has been
a
> hack?.
> Looking around in files and folders i found in /var/log/httpd/ a LARGE
error
> file:
>
> -rw-r--r--   1 root     root     2147 483 647 Sep 18 21:06 error  (almost
> 2000 mb?)
>
> Can this be? and what can i do?
>
> Best regards
>
> K Schantz
> euroweb as
> Norway