httpd-nobody processes with high load

[ramil]

Hi,

The apache version is 1.3.36, running with suexec, and server load is very high with this httpd-nobody processes:


PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
21622 nobody 17 0 17556 9612 2880 R 32.0 2.1 0:58.45 httpd
21618 nobody 16 0 17232 8960 2476 S 22.4 2.0 0:37.09 httpd
5513 nobody 15 0 16620 7972 2180 S 12.7 1.8 0:00.04 httpd
21612 nobody 15 0 17180 9064 2612 S 3.4 2.0 0:44.51 httpd
21643 nobody 15 0 17536 9712 2908 S 4.2 2.2 0:28.64 httpd
27964 nobody 16 0 17304 9012 2456 S 0.2 2.0 0:25.72 httpd
4867 nobody 15 0 17180 8848 2432 S 0.2 2.0 0:01.28 httpd
5612 nobody 15 0 15588 6980 2200 S 0.2 1.5 0:00.02 httpd
.......

The cgi and php scripts are not running under nobody user, so how can I find a websites which uses this nobody processes?

Regards

[webignition]

Take a look at http://forums.cpanel.net/showthread.php?t=54659

[ramil]

after running a nobody_check script got a messages like 'httpd is httpd', is it normal?

[webignition]

after running a nobody_check script got a messages like 'httpd is httpd', is it normal?

To be honest I haven't a clue.

Try the thread in the forums of the creators of the tool: http://www.webhostgear.com/forums/showthread.php?t=1048

[ramprage]

Clean or normal means the process is fine, you might be using an older version of nobody check.

The script looks for malicious processes but doesn't tell you what ones are associated with what site.

For that you can do something like this:

ls -lah /proc/21622

To get details about the first httpd process. EG:

ls -lah /proc/30836
total 0
dr-xr-xr-x 5 nobody nobody 0 Jul 5 04:43 ./
dr-xr-xr-x 229 root root 0 Jun 29 00:28 ../
dr-xr-xr-x 2 root root 0 Jul 5 10:15 attr/
-r-------- 1 root root 0 Jul 5 10:15 auxv
-r--r--r-- 1 root root 0 Jul 5 04:45 cmdline
lrwxrwxrwx 1 root root 0 Jul 5 09:55 cwd -> /home/username/public_html/member/mail/
-r-------- 1 root root 0 Jul 5 10:15 environ
lrwxrwxrwx 1 root root 0 Jul 5 04:45 exe -> /usr/local/apache/bin/httpd*

[mickalo]

Hello,

we installed this the other day, nice little tool. but for some reason, it does not send out an email after it runs. we set the to=root, to=root@localhost and tried setting it my own email address, but nothing is ever sent.

has anyone had this problem and if fixed, how did you fix it ??

CANCEL THIS.... It only sends out an email if something is detected! If all fails, read the direction

TIA,
Mickalo