The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

high mysql loads

Discussion in 'General Discussion' started by InternetPEI, Jan 20, 2006.

  1. InternetPEI

    InternetPEI Well-Known Member

    Joined:
    May 26, 2003
    Messages:
    102
    Likes Received:
    0
    Trophy Points:
    16
    Been getting this in the processes when I hit on trace..

    Is it a bad script or someone wanting in?

    Thanks



    pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117352) = 54
    pread(65, "\3\0F\2\24e\10\0\0D\0\0\0\tcigare", 20, 117408) = 20
    pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117428) = 54
    pread(65, "\3\0F\2\24f\10\0\0B\0\0\0\tcigare", 20, 117484) = 20
    pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117504) = 54
    pread(65, "\3\0F\2\24g\10\0\0$\4\0\0\tcigare", 20, 117560) = 20
    pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117580) = 54
    pread(65, "\3\0F\2\24h\10\0\0%\4\0\0\tcigare", 20, 117636) = 20
    pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117656) = 54
    pread(65, "\3\0F\2\24i\10\0\0K\0\0\0\tcigare", 20, 117712) = 20
    pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117732) = 54
    pread(65, "\3\0F\2\24j\10\0\0\3\0\0\0\tcigare", 20, 117788) = 20
    pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117808) = 54
    pread(65, "\3\0F\2\24k\10\0\0\v\0\0\0\tcigare", 20, 117864) = 20
    pread(65, "tte\25\0cigarette smoking bad\27ip176"..., 54, 117884) = 54
    pread(65, "\3\0K\1\24l\10\0\0C\3\0\0\6parten", 20, 117940) = 20
    pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 117960) = 59
    pread(65, "\3\0K\1\24m\10\0\0F\3\0\0\6parten", 20, 118020) = 20
    pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118040) = 59
    pread(65, "\3\0K\1\24n\10\0\0005\0\0\0\6parten", 20, 118100) = 20
    pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118120) = 59
    pread(65, "\3\0K\1\24o\10\0\0+\0\0\0\6parten", 20, 118180) = 20
    pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118200) = 59
    pread(65, "\3\0K\1\24p\10\0\0D\0\0\0\6parten", 20, 118260) = 20
    pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118280) = 59
    pread(65, "\3\0K\1\24q\10\0\0B\0\0\0\6parten", 20, 118340) = 20
    pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118360) = 59
    pread(65, "\3\0K\1\24r\10\0\0$\4\0\0\6parten", 20, 118420) = 20
    pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118440) = 59
    pread(65, "\3\0K\1\24s\10\0\0%\4\0\0\6parten", 20, 118500) = 20
    pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118520) = 59
    pread(65, "\3\0K\1\24t\10\0\0\3\0\0\0\6parten", 20, 118580) = 20
    pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118600) = 59
    pread(65, "\3\0K\1\24u\10\0\0K\0\0\0\6parten", 20, 118660) = 20
    pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118680) = 59
    pread(65, "\3\0K\1\24v\10\0\0\v\0\0\0\6parten", 20, 118740) = 20
    pread(65, "\35\0mikluho maklay is my favorite\27"..., 59, 118760) = 59
    pread(65, "\3\0O\1\24w\10\0\0C\3\0\0\5maaal\"", 20, 118820) = 20
    pread(65, "\0my name is maaal, i like you si"..., 63, 118840) = 63
    pread(65, "\3\0O\1\24x\10\0\0F\3\0\0\5maaal\"", 20, 118904) = 20
    pread(65, "\0my name is maaal, i like you si"..., 63, 118924) = 63
    pread(65, "\3\0O\1\24y\10\0\0005\0\0\0\5maaal\"", 20, 118988) = 20
    pread(65, "\0my name is maaal, i like you si"..., 63, 119008) = 63
     
  2. AndyReed

    AndyReed Well-Known Member
    PartnerNOC

    Joined:
    May 29, 2004
    Messages:
    2,222
    Likes Received:
    3
    Trophy Points:
    38
    Location:
    Minneapolis, MN
    This is a result of a bad/insecure Php script. I suggest you secure your server and now. Search these forums on howto.
     
  3. InternetPEI

    InternetPEI Well-Known Member

    Joined:
    May 26, 2003
    Messages:
    102
    Likes Received:
    0
    Trophy Points:
    16
  4. jols

    jols Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,111
    Likes Received:
    2
    Trophy Points:
    38
    I've been getting high mysql loads as well.

    What do you mean when you say, "when I hit on trace..."?

    How do you call up a trace like this? Something like %trace [PID} ?
     
  5. InternetPEI

    InternetPEI Well-Known Member

    Joined:
    May 26, 2003
    Messages:
    102
    Likes Received:
    0
    Trophy Points:
    16

    WHM-Show Current CPU Usage (under System Health)-click on the PID-Click Trace

    Check your tmp.. looked like mine was due to a exploit in advanced guestbook that a client had installed.
     
  6. jols

    jols Well-Known Member

    Joined:
    Mar 13, 2004
    Messages:
    1,111
    Likes Received:
    2
    Trophy Points:
    38
    Thanks very much.
     
Loading...

Share This Page