The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

httpd-nobody processes with high load

Discussion in 'General Discussion' started by ramil, Jul 4, 2006.

  1. ramil

    ramil Active Member

    Joined:
    Dec 28, 2003
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    6
    Hi,

    The apache version is 1.3.36, running with suexec, and server load is very high with this httpd-nobody processes:


    PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
    21622 nobody 17 0 17556 9612 2880 R 32.0 2.1 0:58.45 httpd
    21618 nobody 16 0 17232 8960 2476 S 22.4 2.0 0:37.09 httpd
    5513 nobody 15 0 16620 7972 2180 S 12.7 1.8 0:00.04 httpd
    21612 nobody 15 0 17180 9064 2612 S 3.4 2.0 0:44.51 httpd
    21643 nobody 15 0 17536 9712 2908 S 4.2 2.2 0:28.64 httpd
    27964 nobody 16 0 17304 9012 2456 S 0.2 2.0 0:25.72 httpd
    4867 nobody 15 0 17180 8848 2432 S 0.2 2.0 0:01.28 httpd
    5612 nobody 15 0 15588 6980 2200 S 0.2 1.5 0:00.02 httpd
    .......

    The cgi and php scripts are not running under nobody user, so how can I find a websites which uses this nobody processes?

    Regards
     
  2. webignition

    webignition Well-Known Member

    Joined:
    Jan 22, 2005
    Messages:
    1,880
    Likes Received:
    0
    Trophy Points:
    36
  3. ramil

    ramil Active Member

    Joined:
    Dec 28, 2003
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    6
    after running a nobody_check script got a messages like 'httpd is httpd', is it normal?
     
  4. webignition

    webignition Well-Known Member

    Joined:
    Jan 22, 2005
    Messages:
    1,880
    Likes Received:
    0
    Trophy Points:
    36
  5. ramprage

    ramprage Well-Known Member

    Joined:
    Jul 21, 2002
    Messages:
    667
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Canada
    Clean or normal means the process is fine, you might be using an older version of nobody check.

    The script looks for malicious processes but doesn't tell you what ones are associated with what site.

    For that you can do something like this:

    ls -lah /proc/21622

    To get details about the first httpd process. EG:

    ls -lah /proc/30836
    total 0
    dr-xr-xr-x 5 nobody nobody 0 Jul 5 04:43 ./
    dr-xr-xr-x 229 root root 0 Jun 29 00:28 ../
    dr-xr-xr-x 2 root root 0 Jul 5 10:15 attr/
    -r-------- 1 root root 0 Jul 5 10:15 auxv
    -r--r--r-- 1 root root 0 Jul 5 04:45 cmdline
    lrwxrwxrwx 1 root root 0 Jul 5 09:55 cwd -> /home/username/public_html/member/mail/
    -r-------- 1 root root 0 Jul 5 10:15 environ
    lrwxrwxrwx 1 root root 0 Jul 5 04:45 exe -> /usr/local/apache/bin/httpd*
     
  6. mickalo

    mickalo Well-Known Member

    Joined:
    Apr 16, 2002
    Messages:
    765
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    N.W. Iowa
    Hello,

    we installed this the other day, nice little tool. but for some reason, it does not send out an email after it runs. we set the to=root, to=root@localhost and tried setting it my own email address, but nothing is ever sent.

    has anyone had this problem and if fixed, how did you fix it ??

    CANCEL THIS.... It only sends out an email if something is detected! If all fails, read the direction :)

    TIA,
    Mickalo
     
    #6 mickalo, Nov 28, 2006
    Last edited: Nov 28, 2006
Loading...

Share This Page