Oct 21, 2005
7
0
151
Auburndale, Florida
I have a general question, when I look at the background processes in WHM, I have a lot
of duplicate processes running, especially named (6 instances) and my SQL (also has 6 instances) is this normal or is it an instance running for each account?

I don't think thats it because there is more accounts than instances running,
Any thoughts on the matter.

Thanks,
Jeff

PS Here is a copy of the processes:

1 (init) /sbin/init /
init
17218 (syslogd) /sbin/syslogd /
syslogd -m 0
17333 (named) /usr/sbin/named /var/named
/usr/sbin/named -u named

17334 (named) /usr/sbin/named /var/named
/usr/sbin/named -u named
17337 (named) /usr/sbin/named /var/named
/usr/sbin/named -u named
17338 (named) /usr/sbin/named /var/named
/usr/sbin/named -u named
17341 (named) /usr/sbin/named /var/named
/usr/sbin/named -u named
17342 (named) /usr/sbin/named /var/named
/usr/sbin/named -u named
17408 (sshd) /usr/sbin/sshd /
/usr/sbin/sshd
17632 (xinetd) /usr/sbin/xinetd /
xinetd -stayalive -pidfile /var/run/xinetd.pid
27201 (chkservd) /usr/bin/perl /
chkservd
27455 (exim) /usr/sbin/exim /var/spool/exim
/usr/sbin/exim -bd -oX 26
27469 (exim) /usr/sbin/exim /var/spool/exim
/usr/sbin/exim -bd -q60m
27477 (exim) /usr/sbin/exim /var/spool/exim
/usr/sbin/exim -tls-on-connect -bd -oX 465
27744 (antirelayd) /usr/bin/perl /
antirelayd
6848 (spamd) /usr/bin/perl /
/usr/bin/spamd -d --allowed-ips=127.0.0.1 --pidfile=/var/run/spamd.pid -
-max-children=5
9194 (httpd) /usr/local/apache/bin/httpd /
/usr/local/apache/bin/httpd -DSSL
9216 (crond) /usr/sbin/crond /var/spool
crond
10138 (mysqld_safe) /bin/bash /
/bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --pid-
file=/var/lib/mysql/adam.hostingforchristians.net.pid
11714 (mysqld) /usr/sbin/mysqld /var/lib/mysql
/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --
pid-file=/var/lib/mysql/adam.hostingforchristians.net.pid --skip-
locking
12491 (mysqld) /usr/sbin/mysqld /var/lib/mysql
/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --
pid-file=/var/lib/mysql/adam.hostingforchristians.net.pid --skip-
locking
12492 (mysqld) /usr/sbin/mysqld /var/lib/mysql
/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --
pid-file=/var/lib/mysql/adam.hostingforchristians.net.pid --skip-
locking
12493 (mysqld) /usr/sbin/mysqld /var/lib/mysql
/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --
pid-file=/var/lib/mysql/adam.hostingforchristians.net.pid --skip-
locking
12494 (mysqld) /usr/sbin/mysqld /var/lib/mysql
/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --
pid-file=/var/lib/mysql/adam.hostingforchristians.net.pid --skip-
locking
12495 (mysqld) /usr/sbin/mysqld /var/lib/mysql
/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --
pid-file=/var/lib/mysql/adam.hostingforchristians.net.pid --skip-
locking
13409 (spamd) /usr/bin/perl /
spamd child
13473 (spamd) /usr/bin/perl /
spamd child
13857 (mysqld) /usr/sbin/mysqld /var/lib/mysql
/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --
pid-file=/var/lib/mysql/adam.hostingforchristians.net.pid --skip-
locking
13889 (mysqld) /usr/sbin/mysqld /var/lib/mysql
/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --
pid-file=/var/lib/mysql/adam.hostingforchristians.net.pid --skip-
locking
13921 (mysqld) /usr/sbin/mysqld /var/lib/mysql
/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --
pid-file=/var/lib/mysql/adam.hostingforchristians.net.pid --skip-
locking
13985 (mysqld) /usr/sbin/mysqld /var/lib/mysql
/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --
pid-file=/var/lib/mysql/adam.hostingforchristians.net.pid --skip-
locking
14173 (eximstats) /usr/bin/perl /
/usr/bin/perl /usr/local/cpanel/bin/eximstats
14175 (mysqld) /usr/sbin/mysqld /var/lib/mysql
/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --
pid-file=/var/lib/mysql/adam.hostingforchristians.net.pid --skip-
locking
17515 (cpanellogd) /usr/bin/perl /
cpanellogd - sleeping for logs
26680 (entropychat) /usr/bin/perl /
entropychat
28002 (melange) /usr/local/cpanel/3rdparty/ /
/usr/local/cpanel/bin/startmelange
30752 (cppop) /usr/local/cpanel/bin/cppop /
cppop - accepting on port 110
19872 (mailmanctl) /usr/bin/python /usr/local/cpanel/3rdparty/m
/usr/bin/python /usr/local/cpanel/3rdparty/mailman/bin/mailmanctl -s
start
20834 (python) /usr/bin/python /usr/local/cpanel/3rdparty/m
/usr/bin/python /usr/local/cpanel/3rdparty/mailman/bin/qrunner --
runner=ArchRunner:0:1 -s
20864 (python) /usr/bin/python /usr/local/cpanel/3rdparty/m
/usr/bin/python /usr/local/cpanel/3rdparty/mailman/bin/qrunner --
runner=BounceRunner:0:1 -s
20896 (python) /usr/bin/python /usr/local/cpanel/3rdparty/m
/usr/bin/python /usr/local/cpanel/3rdparty/mailman/bin/qrunner --
runner=CommandRunner:0:1 -s
21012 (python) /usr/bin/python /usr/local/cpanel/3rdparty/m
/usr/bin/python /usr/local/cpanel/3rdparty/mailman/bin/qrunner --
runner=IncomingRunner:0:1 -s
21013 (python) /usr/bin/python /usr/local/cpanel/3rdparty/m
/usr/bin/python /usr/local/cpanel/3rdparty/mailman/bin/qrunner --
runner=NewsRunner:0:1 -s
21014 (python) /usr/bin/python /usr/local/cpanel/3rdparty/m
/usr/bin/python /usr/local/cpanel/3rdparty/mailman/bin/qrunner --
runner=OutgoingRunner:0:1 -s
21824 (python) /usr/bin/python /usr/local/cpanel/3rdparty/m
/usr/bin/python /usr/local/cpanel/3rdparty/mailman/bin/qrunner --
runner=VirginRunner:0:1 -s
21856 (python) /usr/bin/python /usr/local/cpanel/3rdparty/m
/usr/bin/python /usr/local/cpanel/3rdparty/mailman/bin/qrunner --
runner=RetryRunner:0:1 -s
23617 (portsentry) /usr/sbin/portsentry /
/usr/sbin/portsentry -tcp
15939 (pure-ftpd) /usr/sbin/pure-ftpd /
pure-ftpd (SERVER)
16034 (pure-authd) /usr/sbin/pure-authd /
/usr/sbin/pure-authd -s /var/run/ftpd.sock -r /usr/sbin/pureauth
2710 (httpd) /usr/local/apache/bin/httpd /home/im4jesus/public_html/s
/usr/local/apache/bin/httpd -DSSL
9601 (httpd) /usr/local/apache/bin/httpd /home/im4jesus/public_html/s
/usr/local/apache/bin/httpd -DSSL
320 (httpd) /usr/local/apache/bin/httpd /home/im4jesus/public_html/s
/usr/local/apache/bin/httpd -DSSL
31426 (stunnel-4.04lo /usr/bin/stunnel-4.04local /usr/local/cpanel/var/run/st
/usr/bin/stunnel-4.04local
/usr/local/cpanel/etc/stunnel/default/stunnel.conf.run
3842 (cpsrvd) /usr/local/cpanel/cpsrvd /usr/local/cpanel/base
cpsrvd - waiting for connections
29793 (stunnel-4.04lo /usr/bin/stunnel-4.04local /usr/local/cpanel/var/run/st
/usr/bin/stunnel-4.04local
/usr/local/cpanel/etc/stunnel/default/stunnel.conf.run
1227 (stunnel-4.04lo /usr/bin/stunnel-4.04local /usr/local/cpanel/var/run/st
/usr/bin/stunnel-4.04local
/usr/local/cpanel/etc/stunnel/default/stunnel.conf.run
1230 (cpsrvd) /usr/local/cpanel/cpsrvd /usr/local/cpanel/whostmgr/d
whostmgrd - serving 127.0.0.1
1237 (whostmgr) /usr/local/cpanel/whostmgr/ /usr/local/cpanel/whostmgr/d
/usr/local/cpanel/whostmgr/bin/whostmgr ./simpleps
3266 (simpleps) /usr/bin/perl /usr/local/cpanel/whostmgr/d
/usr/bin/perl /scripts/simpleps

I know that an additionial exim is running on port 26 (on purpose, my ISP blocks port 25)
but is the rest of this log normal?

Just want to know, thanks.
 
Last edited:

antodeepak

Active Member
Jan 24, 2005
34
0
156
kerala, India
Process

Hi Dear Friend,

At certain times the load will go over and we will see so many process with different services like MYSql, Exim, apache. What i recommend you to check with the WHM/CPU Usage at very first and you can catch the bitch who causing this. If you haven't noticed anything seriously with that, please check with the /tmp directory and look for any scripts that is getting executed by user "nobody". Please delete or change the perm to 000 with owner/group to "root".

There is also certain possibilities with /var/spool/cron..check for any cron job with the user nobody? If please check the cron and find what is the characterstics of the cron and the user who set that. Please go a head with suspending the particular user with the prior information and delete the cron job.

Also have a check with the /usr/local/apache/proxy for any maliciuos script.

Hope everything will fix. :)