LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 10-29-2012, 12:10 AM   #1
nasmii
LQ Newbie
 
Registered: Oct 2012
Posts: 3

Rep: Reputation: Disabled
Question Hugh Number if <user>@notty processors


Hi team,

Im new to this forum,

In my linux system I found thousands of processors running as below:

<useranme> 32709 32653 0 Oct19 ? 00:00:00 sshd: <username>@notty
<useranme> 32711 32675 0 Oct17 ? 00:00:00 sshd: <useranme>@notty
<useranme> 32716 32709 0 Oct19 ? 00:00:00 /usr/lib64/ssh/sftp-server

We were able to remove them by killing the process.

I would like to know the Reason why this much processors start in my server.

Thank you,
ID
 
Old 10-29-2012, 12:33 AM   #2
nasmii
LQ Newbie
 
Registered: Oct 2012
Posts: 3

Original Poster
Rep: Reputation: Disabled
Exclamation Hugh Number of <user>@notty processors

Correction in Subject : Hugh Number if <user>@notty processors

Quote:
Originally Posted by nasmii View Post
Hi team,

Im new to this forum,

In my linux system I found thousands of processors running as below:

<useranme> 32709 32653 0 Oct19 ? 00:00:00 sshd: <username>@notty
<useranme> 32711 32675 0 Oct17 ? 00:00:00 sshd: <useranme>@notty
<useranme> 32716 32709 0 Oct19 ? 00:00:00 /usr/lib64/ssh/sftp-server

We were able to remove them by killing the process.

I would like to know the Reason why this much processors start in my server.

Thank you,
ID
 
Old 10-29-2012, 11:44 AM   #3
shivaa
Senior Member
 
Registered: Jul 2012
Location: Grenoble, Fr.
Distribution: Sun Solaris, RHEL, Ubuntu, Debian 6.0
Posts: 1,800
Blog Entries: 4

Rep: Reputation: 286Reputation: 286Reputation: 286
It seems some user <username> is logged in on this system from host notty.
Did you try following?
Quote:
pkill -9 -u <username>

Last edited by shivaa; 10-29-2012 at 11:46 AM.
 
Old 10-29-2012, 12:30 PM   #4
nasmii
LQ Newbie
 
Registered: Oct 2012
Posts: 3

Original Poster
Rep: Reputation: Disabled
Thank you shivaa for the reply.

I was able to remove the processors.
Can anyone help me to find out reason for these processors and how can I avoid same issue again.
Initially there were few thousands with same process

Thank you,
 
Old 10-29-2012, 12:39 PM   #5
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 7,151

Rep: Reputation: 2203Reputation: 2203Reputation: 2203Reputation: 2203Reputation: 2203Reputation: 2203Reputation: 2203Reputation: 2203Reputation: 2203Reputation: 2203Reputation: 2203
It might do well to move this to the Security subforum, but in the meanwhile, here are a few suggestions...

Look at the various system logs in /var/log. Do you know very well what this computer is supposed to be doing? Is there any reason that you can think of for this kind of login to be legitimate? If so, it's possible that these are hanging-sessions that are not being cleared up. Maybe they are being initiated by a (let us presume, "legitimate") programmed script, somewhere else, that has a bug in it. ("It doesn't get the response it's looking for, so it tries again. But it doesn't clean up its own mess.") It's pretty unreasonable to think of any person generating this kind of volume, but it's also difficult to imagine an intruder creating such a massive amount of noise, unless he were somehow (and crudely) attempting some weird DOS attack. A "bug" sounds likely to me.

Language notes:

"hugh" should be "huge." "processors" in this case should be "processes" or "sessions."

Last edited by sundialsvcs; 10-29-2012 at 12:41 PM.
 
Old 10-29-2012, 12:47 PM   #6
shivaa
Senior Member
 
Registered: Jul 2012
Location: Grenoble, Fr.
Distribution: Sun Solaris, RHEL, Ubuntu, Debian 6.0
Posts: 1,800
Blog Entries: 4

Rep: Reputation: 286Reputation: 286Reputation: 286
These were obviously not zombie or orphan processess, but, these were because of "ssh" commands initiated by some user <username>, who was logged in on your local system, and had did a "ssh <username>@notty" to access notty system using ssh.
Al those processes were many times opened sessions (i.e. terminals) by that user. He logged in from your system and didn't close those terminals or login sessions. That's why you found lot of such processes. You can ask users to limit their sessions and always close/logoff from terminals after they finish their work, else you'll close it.
Fyi, pkill kills processes of specified user and -9 is signal passed to that process. Read more "man kill".

Last edited by shivaa; 10-29-2012 at 01:19 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Number of XMM registers in multicore processors iam_techno Programming 1 03-13-2012 02:44 PM
How to find the number of physical processors and architecture in a hp-ux machine shawshank_blr Other *NIX 3 07-24-2009 10:24 AM
How to find the number of physical processors in a AIX machine shawshank_blr AIX 13 07-17-2009 11:08 PM
LXer: Howto display the number of processors in Linux LXer Syndicated Linux News 0 09-02-2007 08:50 PM
Getting the number of processors spaaarky21 Programming 11 11-20-2005 02:44 PM


All times are GMT -5. The time now is 10:49 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration