SV: [cobalt-security] urgent question

["Kai r. s., euroweb as" <kai@xxxxxxxxxx>]

Hi, and thanks for giving me helpful tips.

I did not include (-9) next time i will,(thanks)

When it comes to finding the error it was almost inposible to find anything
in a 2000 mb error log! what I could se was mostely root.exe and cmd.exe
errors, but there could have been like a million errors i did not have time
to see. The funny thing was that it stopped log rotating the first hours,
but when i came back to look for more errors later that evening the error
log suddentely where back to normal size? where have it all gone? This is
bugging my brain, and to be honest i don`t have a clue what happend. As you
proberly understand i am a newbi in linux/apache.I will be glad for any help
in pointing me the right way.

Kai




Not too sure what the problem is, but when you did the kills did you try:
kill -9 pid
which usually kills processes quite well. Sometimes when you just send a
process the
usual kill command it will try and quit nicely, sometimes wait to finish
what it is doing.
Using the -9 kinda hurries things up a bit by really killing the process (I
beleive -9 sends
the process a bus error).
As to what went wrong, check the logs as suggested above, is it possible a
cgi-script
started printing to STDERR?
Gareth

> Hi, I have a rather urgent question.
>
> Today my raq3i server sent a alert massage that it was having very high
cpu
> usage. I ran "top" and there it was 4-5 httpd ps (/usr/sbin/httpd -f
> /etc/httpd/conf/httpd.confthat) where using all cpu, and some of them had
> been running for 3-4h. I tryed to stop the prosesses with kill pid, but
they
> would not go down. I needed to stop the webserver to kill them.
>
> I am now serhing for the reasson for this (tips needed), maybe it has been
a
> hack?.
> Looking around in files and folders i found in /var/log/httpd/ a LARGE
error
> file:
>
> -rw-r--r--   1 root     root     2147 483 647 Sep 18 21:06 error  (almost
> 2000 mb?)
>
> Can this be? and what can i do?
>
> Best regards
>
> K Schantz
> euroweb as
> Norway



_______________________________________________
cobalt-security mailing list
cobalt-security@xxxxxxxxxxxxxxx
http://list.cobalt.com/mailman/listinfo/cobalt-security