Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

CSF Firewall giving lfd sql error?

Discussion in 'Database Discussion' started by Chriz1977, Jun 22, 2009.

  1. Chriz1977

    Chriz1977 Well-Known Member

    Joined:
    Sep 18, 2006
    Messages:
    191
    Likes Received:
    0
    Trophy Points:
    166
    Hi

    I run ConfigServer Firewall on my server and seem to have had a lot of ldf warnings about sql in the past few days. The message is this :

    Time: Mon Jun 22 21:04:32 2009 +0100
    PID: 18547
    Account: mysql
    Uptime: 154022 seconds


    Executable:

    /usr/sbin/mysqld\004a3d8a13\00\90\a3k\n\00\00\00 (deleted)

    The file system shows this process is running an executable file that has been deleted. This typically happens when the original file has been replaced by a new file when the application is updated. To prevent this being reported again, restart the process that runs this excecutable file. See csf.conf and the PT_DELETED text for more information about the security implications of processes running deleted executable files.


    Command Line (often faked in exploits):

    /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/server.xxx.com.pid --skip-external-locking


    Network connections by the process (if any):

    tcp: 0.0.0.0:3306 -> 0.0.0.0:0


    Files open by the process (if any):

    /dev/null
    /var/lib/mysql/server.xxx.com.err
    /var/lib/mysql/server.xxx.com.err
    /var/lib/mysql/ibdata1
    /tmp/ibHPIa1D (deleted)
    /tmp/ibGPGFLX (deleted)
    /tmp/ibdtabwh (deleted)
    /tmp/ibL740gB (deleted)
    /var/lib/mysql/ib_logfile0
    /var/lib/mysql/ib_logfile1
    /tmp/ib8TxB3U (deleted)
    /var/lib/mysql/eximstats/smtp.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_components.MYI
    /var/lib/mysql/myukhost_coin1/phpcoin_banned.MYI
    /var/lib/mysql/gathera_wrdp1/wp_term_relationships.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_banner.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_session.MYI
    /var/lib/mysql/gathera_wrdp1/wp_postmeta.MYI
    /var/lib/mysql/myukhost_coin1/phpcoin_banned.MYD
    /var/lib/mysql/eximstats/smtp.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_groups.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_session.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_groups.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_menu.MYD
    /var/lib/mysql/palzyco_mail/sm_solo.MYI
    /var/lib/mysql/palzyco_mail/sm_solo.MYD
    /var/lib/mysql/palzyco_mail/sm_domains.MYI
    /var/lib/mysql/palzyco_mail/sm_domains.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_menu.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_categories.MYI
    /var/lib/mysql/mancunia_wrdp1/wp_postmeta.MYI
    /var/lib/mysql/myukhost_coin1/phpcoin_sessions.MYI
    /var/lib/mysql/myukhost_coin1/phpcoin_parameters.MYI
    /var/lib/mysql/artshop_ebay/categories.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_components.MYD
    /var/lib/mysql/gathera_wrdp1/wp_postmeta.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_users.MYI
    /var/lib/mysql/gathera_wrdp1/wp_comments.MYI
    /var/lib/mysql/myukhost_coin1/phpcoin_parameters.MYD
    /var/lib/mysql/watchavi_home/userlog.MYI
    /var/lib/mysql/gathera_wrdp2/wp_term_relationships.MYI
    /var/lib/mysql/bosshos_whmcs/tblannouncements.MYI
    /var/lib/mysql/gathera_wrdp1/wp_users.MYI
    /var/lib/mysql/gathera_wrdp2/wp_usermeta.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_modules.MYI
    /var/lib/mysql/gathera_wrdp1/wp_posts.MYI
    /var/lib/mysql/artshop_ebay/categories.MYD
    /var/lib/mysql/gathera_wrdp2/wp_term_relationships.MYD
    /var/lib/mysql/mancunia_wrdp1/wp_options.MYI
    /var/lib/mysql/gathera_wrdp1/wp_users.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_content.MYI
    /var/lib/mysql/gathera_wrdp1/wp_usermeta.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_modules.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_users.MYD
    /var/lib/mysql/watchavi_home/online_users.MYI
    /var/lib/mysql/gathera_wrdp2/wp_comments.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_templates_menu.MYI
    /var/lib/mysql/gathera_wrdp1/wp_options.MYI
    /var/lib/mysql/bosshos_whmcs/tblannouncements.MYD
    /var/lib/mysql/gathera_wrdp2/wp_users.MYI
    /var/lib/mysql/watchavi_home/online_users.MYD
    /var/lib/mysql/gathera_wrdp1/wp_posts.MYD
    /var/lib/mysql/watchavi_home/siteconfig.MYI
    /var/lib/mysql/mancunia_wrdp1/wp_usermeta.MYI
    /var/lib/mysql/gathera_wrdp2/wp_terms.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_modules_menu.MYI
    /var/lib/mysql/gathera_wrdp1/wp_usermeta.MYD
    /var/lib/mysql/watchavi_home/banners.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_sections.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_categories.MYD
    /var/lib/mysql/myukhost_coin1/phpcoin_versions.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_stats_agents.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_sections.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_modules_menu.MYD
    /var/lib/mysql/watchavi_home/banners.MYD
    /var/lib/mysql/myukhost_coin1/phpcoin_sessions.MYD
    /var/lib/mysql/gathera_wrdp2/wp_options.MYI
    /var/lib/mysql/mancunia_wrdp1/wp_postmeta.MYD
    /var/lib/mysql/mancunia_wrdp1/wp_posts.MYI
    /var/lib/mysql/gathera_wrdp1/wp_terms.MYI
    /var/lib/mysql/watchavi_home/banned.MYI
    /var/lib/mysql/webeses_razas/general.MYI
    /var/lib/mysql/myukhost_coin1/phpcoin_components.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_menu.MYD
    /var/lib/mysql/mancunia_wrdp1/wp_posts.MYD
    /var/lib/mysql/webeses_razas/general.MYD
    /var/lib/mysql/gathera_wrdp1/wp_term_relationships.MYD
    /var/lib/mysql/eximstats/sends.MYI
    /var/lib/mysql/gathera_wrdp2/wp_options.MYD
    /var/lib/mysql/gathera_wrdp2/wp_terms.MYD
    /var/lib/mysql/artshop_ebay/ads.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_content_frontpage.MYI
    /var/lib/mysql/gathera_wrdp1/wp_comments.MYD
    /var/lib/mysql/gathera_wrdp2/wp_users.MYD
    /var/lib/mysql/gathera_wrdp2/wp_usermeta.MYD
    /var/lib/mysql/myukhost_coin1/phpcoin_site_info.MYI
    /var/lib/mysql/myukhost_coin1/phpcoin_site_info.MYD
    /var/lib/mysql/watchavi_home/userlog.MYD
    /var/lib/mysql/mancunia_wrdp1/wp_term_relationships.MYI
    /var/lib/mysql/mancunia_wrdp1/wp_term_relationships.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_banner.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_templates_menu.MYD
    /var/lib/mysql/gathera_wrdp1/wp_options.MYD
    /var/lib/mysql/gathera_wrdp2/wp_term_taxonomy.MYI
    /var/lib/mysql/gathera_wrdp2/wp_posts.MYI
    /var/lib/mysql/artshop_ebay/options.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_mambots.MYI
    /var/lib/mysql/gathera_wrdp2/wp_postmeta.MYI
    /var/lib/mysql/watchavi_home/banned.MYD
    /var/lib/mysql/mancunia_wrdp1/wp_usermeta.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_stats_agents.MYD
    /var/lib/mysql/gathera_wrdp2/wp_term_taxonomy.MYD
    /var/lib/mysql/gathera_wrdp1/wp_terms.MYD
    /var/lib/mysql/myukhost_coin1/phpcoin_menu_blocks.MYI
    /var/lib/mysql/mancunia_wrdp1/wp_term_taxonomy.MYI
    /var/lib/mysql/eurosky_euroskytv/jos_content.MYD
    /var/lib/mysql/eximstats/sends.MYD
    /var/lib/mysql/artshop_ebay/options.MYD
    /var/lib/mysql/myukhost_coin1/phpcoin_menu_blocks.MYD
    /var/lib/mysql/gathera_wrdp1/wp_term_taxonomy.MYI
    /var/lib/mysql/gathera_wrdp2/wp_postmeta.MYD
    /var/lib/mysql/mancunia_wrdp1/wp_users.MYI
    /var/lib/mysql/mancunia_wrdp1/wp_users.MYD
    /var/lib/mysql/gathera_wrdp1/wp_term_taxonomy.MYD
    /var/lib/mysql/mancunia_wrdp1/wp_term_taxonomy.MYD
    /var/lib/mysql/gathera_wrdp2/wp_posts.MYD
    /var/lib/mysql/mancunia_wrdp1/wp_options.MYD
    /var/lib/mysql/myukhost_coin1/phpcoin_versions.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_content_frontpage.MYD
    /var/lib/mysql/myukhost_coin1/phpcoin_menu_blocks_items.MYI
    /var/lib/mysql/artshop_ebay/ads.MYD
    /var/lib/mysql/mancunia_wrdp1/wp_terms.MYI
    /var/lib/mysql/mancunia_wrdp1/wp_terms.MYD
    /var/lib/mysql/myukhost_coin1/phpcoin_menu_blocks_items.MYD
    /var/lib/mysql/watchavi_home/siteconfig.MYD
    /var/lib/mysql/myukhost_coin1/phpcoin_components.MYD
    /var/lib/mysql/gathera_wrdp2/wp_comments.MYD
    /var/lib/mysql/eurosky_euroskytv/jos_mambots.MYD

    Has anyone seen this before or know what the problem is?

    Cheers
    Chriz
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    16,429
    Likes Received:
    415
    Trophy Points:
    583
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. brianoz

    brianoz Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,146
    Likes Received:
    6
    Trophy Points:
    168
    Location:
    Melbourne, Australia
    cPanel Access Level:
    Root Administrator
    Try restarting mysql and lfd; we've got that message in the past when mysql has been upgraded on disk but the old copy is still in memory.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice