/usr/local/apache/bin/httpd -t

[netlook]

Hello,

I noticed today strange procesess most intensive in my system:

root 2.19 7.39 2.0
Top Process %CPU 46.0 /usr/local/apache/bin/httpd -t
Top Process %CPU 30.0 /usr/local/apache/bin/httpd -t
Top Process %CPU 21.0 /usr/local/apache/bin/httpd -t

Can somebody explain me what is this?

Thanks a lot!
Tom

[chirpy]

It could be a php exploit. You really need to identify the PID of one of those processes, then run:

lsof | grep PID

It will likely spew out a load of normal apache files, but if it's an exploit, one of them won't be right. Likely, it will have a file open in /tmp or /var/tmp of /dev/shm

[netlook]

Do you have any idea how to identyfi the pid of this process? There is nothing strange when I do ps -aux, but today I had a kernel panic about some zombie who eat all memory (as a tech form DC said).

Thanks

[chirpy]

Oh, I see, you're looking at the stats within cPanel. I guess that could be innocent. You really need to monitor the server from shell using top

You can usually tell if you've got problem services by running the following and seeing if any unexpected ports are open:

netstat -lpn

[anup123]

Did u ever run a httpd -t for syntax check?

Anup

[HostMerit]

Try ps -u nobody

and ps -axfu

And post your results. That could be apache, as Cpanel's process list is slow, and a joke really, or it could be a hanging around process running from a spawned apache process.

[jroes]

I do something like this every time I get on one of my servers (there always seem to be some rogue nobody processes with psybnc's running in them)

ps auxw | grep nobody

I find the pid of the most-suspicious looking httpd process (sometimes they even have extra characters or arguments padded at the end of them), and do this:

ls -la /proc/pid

So, if the process id was something like 1533, then I would type

ls -la /proc/1533

You should be able to tell just by looking at that whether it's legitimate. You might also be able to get further information from

cat /proc/pid/environ

Good luck!