CSF Firewall giving lfd sql error?

[Chriz1977]

Hi

I run ConfigServer Firewall on my server and seem to have had a lot of ldf warnings about sql in the past few days. The message is this :

Time: Mon Jun 22 21:04:32 2009 +0100
PID: 18547
Account: mysql
Uptime: 154022 seconds


Executable:

/usr/sbin/mysqld\004a3d8a13\00\90\a3k\n\00\00\00 (deleted)

The file system shows this process is running an executable file that has been deleted. This typically happens when the original file has been replaced by a new file when the application is updated. To prevent this being reported again, restart the process that runs this excecutable file. See csf.conf and the PT_DELETED text for more information about the security implications of processes running deleted executable files.


Command Line (often faked in exploits):

/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/server.xxx.com.pid --skip-external-locking


Network connections by the process (if any):

tcp: 0.0.0.0:3306 -> 0.0.0.0:0


Files open by the process (if any):

/dev/null
/var/lib/mysql/server.xxx.com.err
/var/lib/mysql/server.xxx.com.err
/var/lib/mysql/ibdata1
/tmp/ibHPIa1D (deleted)
/tmp/ibGPGFLX (deleted)
/tmp/ibdtabwh (deleted)
/tmp/ibL740gB (deleted)
/var/lib/mysql/ib_logfile0
/var/lib/mysql/ib_logfile1
/tmp/ib8TxB3U (deleted)
/var/lib/mysql/eximstats/smtp.MYI
/var/lib/mysql/eurosky_euroskytv/jos_components.MYI
/var/lib/mysql/myukhost_coin1/phpcoin_banned.MYI
/var/lib/mysql/gathera_wrdp1/wp_term_relationships.MYI
/var/lib/mysql/eurosky_euroskytv/jos_banner.MYI
/var/lib/mysql/eurosky_euroskytv/jos_session.MYI
/var/lib/mysql/gathera_wrdp1/wp_postmeta.MYI
/var/lib/mysql/myukhost_coin1/phpcoin_banned.MYD
/var/lib/mysql/eximstats/smtp.MYD
/var/lib/mysql/eurosky_euroskytv/jos_groups.MYI
/var/lib/mysql/eurosky_euroskytv/jos_session.MYD
/var/lib/mysql/eurosky_euroskytv/jos_groups.MYD
/var/lib/mysql/eurosky_euroskytv/jos_menu.MYD
/var/lib/mysql/palzyco_mail/sm_solo.MYI
/var/lib/mysql/palzyco_mail/sm_solo.MYD
/var/lib/mysql/palzyco_mail/sm_domains.MYI
/var/lib/mysql/palzyco_mail/sm_domains.MYD
/var/lib/mysql/eurosky_euroskytv/jos_menu.MYI
/var/lib/mysql/eurosky_euroskytv/jos_categories.MYI
/var/lib/mysql/mancunia_wrdp1/wp_postmeta.MYI
/var/lib/mysql/myukhost_coin1/phpcoin_sessions.MYI
/var/lib/mysql/myukhost_coin1/phpcoin_parameters.MYI
/var/lib/mysql/artshop_ebay/categories.MYI
/var/lib/mysql/eurosky_euroskytv/jos_components.MYD
/var/lib/mysql/gathera_wrdp1/wp_postmeta.MYD
/var/lib/mysql/eurosky_euroskytv/jos_users.MYI
/var/lib/mysql/gathera_wrdp1/wp_comments.MYI
/var/lib/mysql/myukhost_coin1/phpcoin_parameters.MYD
/var/lib/mysql/watchavi_home/userlog.MYI
/var/lib/mysql/gathera_wrdp2/wp_term_relationships.MYI
/var/lib/mysql/bosshos_whmcs/tblannouncements.MYI
/var/lib/mysql/gathera_wrdp1/wp_users.MYI
/var/lib/mysql/gathera_wrdp2/wp_usermeta.MYI
/var/lib/mysql/eurosky_euroskytv/jos_modules.MYI
/var/lib/mysql/gathera_wrdp1/wp_posts.MYI
/var/lib/mysql/artshop_ebay/categories.MYD
/var/lib/mysql/gathera_wrdp2/wp_term_relationships.MYD
/var/lib/mysql/mancunia_wrdp1/wp_options.MYI
/var/lib/mysql/gathera_wrdp1/wp_users.MYD
/var/lib/mysql/eurosky_euroskytv/jos_content.MYI
/var/lib/mysql/gathera_wrdp1/wp_usermeta.MYI
/var/lib/mysql/eurosky_euroskytv/jos_modules.MYD
/var/lib/mysql/eurosky_euroskytv/jos_users.MYD
/var/lib/mysql/watchavi_home/online_users.MYI
/var/lib/mysql/gathera_wrdp2/wp_comments.MYI
/var/lib/mysql/eurosky_euroskytv/jos_templates_menu.MYI
/var/lib/mysql/gathera_wrdp1/wp_options.MYI
/var/lib/mysql/bosshos_whmcs/tblannouncements.MYD
/var/lib/mysql/gathera_wrdp2/wp_users.MYI
/var/lib/mysql/watchavi_home/online_users.MYD
/var/lib/mysql/gathera_wrdp1/wp_posts.MYD
/var/lib/mysql/watchavi_home/siteconfig.MYI
/var/lib/mysql/mancunia_wrdp1/wp_usermeta.MYI
/var/lib/mysql/gathera_wrdp2/wp_terms.MYI
/var/lib/mysql/eurosky_euroskytv/jos_modules_menu.MYI
/var/lib/mysql/gathera_wrdp1/wp_usermeta.MYD
/var/lib/mysql/watchavi_home/banners.MYI
/var/lib/mysql/eurosky_euroskytv/jos_sections.MYI
/var/lib/mysql/eurosky_euroskytv/jos_categories.MYD
/var/lib/mysql/myukhost_coin1/phpcoin_versions.MYI
/var/lib/mysql/eurosky_euroskytv/jos_stats_agents.MYI
/var/lib/mysql/eurosky_euroskytv/jos_sections.MYD
/var/lib/mysql/eurosky_euroskytv/jos_modules_menu.MYD
/var/lib/mysql/watchavi_home/banners.MYD
/var/lib/mysql/myukhost_coin1/phpcoin_sessions.MYD
/var/lib/mysql/gathera_wrdp2/wp_options.MYI
/var/lib/mysql/mancunia_wrdp1/wp_postmeta.MYD
/var/lib/mysql/mancunia_wrdp1/wp_posts.MYI
/var/lib/mysql/gathera_wrdp1/wp_terms.MYI
/var/lib/mysql/watchavi_home/banned.MYI
/var/lib/mysql/webeses_razas/general.MYI
/var/lib/mysql/myukhost_coin1/phpcoin_components.MYI
/var/lib/mysql/eurosky_euroskytv/jos_menu.MYD
/var/lib/mysql/mancunia_wrdp1/wp_posts.MYD
/var/lib/mysql/webeses_razas/general.MYD
/var/lib/mysql/gathera_wrdp1/wp_term_relationships.MYD
/var/lib/mysql/eximstats/sends.MYI
/var/lib/mysql/gathera_wrdp2/wp_options.MYD
/var/lib/mysql/gathera_wrdp2/wp_terms.MYD
/var/lib/mysql/artshop_ebay/ads.MYI
/var/lib/mysql/eurosky_euroskytv/jos_content_frontpage.MYI
/var/lib/mysql/gathera_wrdp1/wp_comments.MYD
/var/lib/mysql/gathera_wrdp2/wp_users.MYD
/var/lib/mysql/gathera_wrdp2/wp_usermeta.MYD
/var/lib/mysql/myukhost_coin1/phpcoin_site_info.MYI
/var/lib/mysql/myukhost_coin1/phpcoin_site_info.MYD
/var/lib/mysql/watchavi_home/userlog.MYD
/var/lib/mysql/mancunia_wrdp1/wp_term_relationships.MYI
/var/lib/mysql/mancunia_wrdp1/wp_term_relationships.MYD
/var/lib/mysql/eurosky_euroskytv/jos_banner.MYD
/var/lib/mysql/eurosky_euroskytv/jos_templates_menu.MYD
/var/lib/mysql/gathera_wrdp1/wp_options.MYD
/var/lib/mysql/gathera_wrdp2/wp_term_taxonomy.MYI
/var/lib/mysql/gathera_wrdp2/wp_posts.MYI
/var/lib/mysql/artshop_ebay/options.MYI
/var/lib/mysql/eurosky_euroskytv/jos_mambots.MYI
/var/lib/mysql/gathera_wrdp2/wp_postmeta.MYI
/var/lib/mysql/watchavi_home/banned.MYD
/var/lib/mysql/mancunia_wrdp1/wp_usermeta.MYD
/var/lib/mysql/eurosky_euroskytv/jos_stats_agents.MYD
/var/lib/mysql/gathera_wrdp2/wp_term_taxonomy.MYD
/var/lib/mysql/gathera_wrdp1/wp_terms.MYD
/var/lib/mysql/myukhost_coin1/phpcoin_menu_blocks.MYI
/var/lib/mysql/mancunia_wrdp1/wp_term_taxonomy.MYI
/var/lib/mysql/eurosky_euroskytv/jos_content.MYD
/var/lib/mysql/eximstats/sends.MYD
/var/lib/mysql/artshop_ebay/options.MYD
/var/lib/mysql/myukhost_coin1/phpcoin_menu_blocks.MYD
/var/lib/mysql/gathera_wrdp1/wp_term_taxonomy.MYI
/var/lib/mysql/gathera_wrdp2/wp_postmeta.MYD
/var/lib/mysql/mancunia_wrdp1/wp_users.MYI
/var/lib/mysql/mancunia_wrdp1/wp_users.MYD
/var/lib/mysql/gathera_wrdp1/wp_term_taxonomy.MYD
/var/lib/mysql/mancunia_wrdp1/wp_term_taxonomy.MYD
/var/lib/mysql/gathera_wrdp2/wp_posts.MYD
/var/lib/mysql/mancunia_wrdp1/wp_options.MYD
/var/lib/mysql/myukhost_coin1/phpcoin_versions.MYD
/var/lib/mysql/eurosky_euroskytv/jos_content_frontpage.MYD
/var/lib/mysql/myukhost_coin1/phpcoin_menu_blocks_items.MYI
/var/lib/mysql/artshop_ebay/ads.MYD
/var/lib/mysql/mancunia_wrdp1/wp_terms.MYI
/var/lib/mysql/mancunia_wrdp1/wp_terms.MYD
/var/lib/mysql/myukhost_coin1/phpcoin_menu_blocks_items.MYD
/var/lib/mysql/watchavi_home/siteconfig.MYD
/var/lib/mysql/myukhost_coin1/phpcoin_components.MYD
/var/lib/mysql/gathera_wrdp2/wp_comments.MYD
/var/lib/mysql/eurosky_euroskytv/jos_mambots.MYD

Has anyone seen this before or know what the problem is?

Cheers
Chriz

[Infopro]

You'll find more reading (and help for CSF) over here:

Process Tracking and csf.pignore - ConfigServer Scripts Forum

[brianoz]

Try restarting mysql and lfd; we've got that message in the past when mysql has been upgraded on disk but the old copy is still in memory.