LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   lt-httpd (Apache I believe) and sshd combining to take up 100% CPU (https://www.linuxquestions.org/questions/linux-newbie-8/lt-httpd-apache-i-believe-and-sshd-combining-to-take-up-100-cpu-4175413337/)

gabriot 06-25-2012 05:59 PM
lt-httpd (Apache I believe) and sshd combining to take up 100% CPU
 
I don't believe it is a DoS attack because when I run "last" all I see are logins from me and running "cat /var/log/messages | grep ssh" comes up with nothing.

I figure perhaps I should restart apache? Here's a ps aux | grep httpd
Code:
ps aux | grep httpd
root    10712  0.0  0.5  58768 10548 ?        Ss  Apr17  0:01 /usr/sbin/.libs/lt-httpd
apache  11512  0.0  0.7  63388 15876 ?        S    Jun24  0:14 /usr/sbin/.libs/lt-httpd
apache  11973  0.0  0.7  63496 15588 ?        S    Jun24  0:13 /usr/sbin/.libs/lt-httpd
root    19560  7.8  0.2  62036  5532 ?        R    Jun24 182:04 /usr/sbin/.libs/lt-httpd
apache  26224  0.0  0.7  63248 15616 ?        S    10:08  0:07 /usr/sbin/.libs/lt-httpd
apache  26235  0.0  0.7  63236 15544 ?        S    10:08  0:08 /usr/sbin/.libs/lt-httpd
apache  26634  0.0  0.6  63356 13404 ?        S    18:29  0:00 /usr/sbin/.libs/lt-httpd
apache  26635  0.0  0.6  63188 12880 ?        S    18:29  0:00 /usr/sbin/.libs/lt-httpd
apache  26636  0.0  0.6  62652 12980 ?        S    18:29  0:00 /usr/sbin/.libs/lt-httpd
root    28787  0.0  0.0  3888  680 pts/0    S+  18:59  0:00 grep httpd
apache  29514  0.0  0.7  63284 15404 ?        S    10:59  0:07 /usr/sbin/.libs/lt-httpd
apache  29550  0.0  0.7  63500 15368 ?        S    11:00  0:07 /usr/sbin/.libs/lt-httpd
apache  29651  0.0  0.7  63392 15756 ?        S    11:02  0:07 /usr/sbin/.libs/lt-httpd
apache  29662  0.0  0.7  63396 15216 ?        S    11:02  0:07 /usr/sbin/.libs/lt-httpd
apache  29666  0.0  0.7  63464 15344 ?        S    11:02  0:07 /usr/sbin/.libs/lt-httpd
apache  29672  0.0  0.7  63336 15528 ?        S    11:02  0:07 /usr/sbin/.libs/lt-httpd
apache  29674  0.0  0.7  63320 15220 ?        S    11:02  0:07 /usr/sbin/.libs/lt-httpd
apache  29678  0.0  0.7  63388 15420 ?        S    11:02  0:06 /usr/sbin/.libs/lt-httpd
apache  29720  0.0  0.7  63640 15912 ?        S    11:03  0:06 /usr/sbin/.libs/lt-httpd
apache  29729  0.0  0.7  62692 15064 ?        S    11:03  0:07 /usr/sbin/.libs/lt-httpd
apache  29767  0.0  0.7  63332 15800 ?        S    11:03  0:07 /usr/sbin/.libs/lt-httpd
apache  29781  0.0  0.7  63192 15560 ?        S    11:04  0:06 /usr/sbin/.libs/lt-httpd
apache  30467  0.0  0.7  63492 16504 ?        S    Jun24  0:23 /usr/sbin/.libs/lt-httpd
apache  30734  0.0  0.7  63396 15272 ?        S    11:18  0:07 /usr/sbin/.libs/lt-httpd
apache  30935  0.0  0.7  63492 15632 ?        S    11:20  0:07 /usr/sbin/.libs/lt-httpd
apache  30936  0.0  0.7  63400 15328 ?        S    11:20  0:07 /usr/sbin/.libs/lt-httpd
apache  31978  0.0  0.7  63344 15716 ?        S    11:38  0:06 /usr/sbin/.libs/lt-httpd
apache  31980  0.0  0.7  63392 15752 ?        S    11:38  0:06 /usr/sbin/.libs/lt-httpd
apache  31984  0.0  0.7  63388 15436 ?        S    11:38  0:07 /usr/sbin/.libs/lt-httpd
apache  31986  0.0  0.7  62864 14764 ?        S    11:38  0:06 /usr/sbin/.libs/lt-httpd
apache  31987  0.0  0.7  63456 15552 ?        S    11:38  0:06 /usr/sbin/.libs/lt-httpd
apache  32195  0.0  0.7  63352 15644 ?        S    11:40  0:06 /usr/sbin/.libs/lt-httpd
apache  32234  0.0  0.7  63404 15420 ?        S    11:41  0:06 /usr/sbin/.libs/lt-httpd
apache  32279  0.0  0.7  63248 15372 ?        S    11:42  0:06 /usr/sbin/.libs/lt-httpd
apache  32293  0.0  0.7  63380 15164 ?        S    11:42  0:06 /usr/sbin/.libs/lt-httpd
apache  32294  0.0  0.7  62868 15228 ?        S    11:42  0:06 /usr/sbin/.libs/lt-httpd
apache  32295  0.0  0.7  63492 15612 ?        S    11:42  0:06 /usr/sbin/.libs/lt-httpd
apache  32329  0.0  0.7  63492 15484 ?        S    11:42  0:06 /usr/sbin/.libs/lt-httpd
apache  32334  0.0  0.7  63168 15152 ?        S    11:42  0:06 /usr/sbin/.libs/lt-httpd
apache  32340  0.0  0.7  63492 15364 ?        S    11:42  0:06 /usr/sbin/.libs/lt-httpd
apache  32343  0.0  0.7  63316 15528 ?        S    11:42  0:06 /usr/sbin/.libs/lt-httpd
apache  32346  0.0  0.7  62948 15516 ?        S    11:42  0:06 /usr/sbin/.libs/lt-httpd

chrism01 06-25-2012 06:12 PM
Rather than do that, I'd look into the apache access_log and error_log. According to this http://slack-linux.blogspot.com.au/2...ate-codes.html the processes are all waiting for an event ...
Also, check the /var/log/mesages by eye, don't grep for ssh.

gabriot 06-25-2012 06:22 PM
I checked the messages file by eye and just saw my own login successes.

The access_log is full of a ton of different lines (that I unfortunately probably should not post into here for security reasons, but it more or less looks to be doing what it "should" be doing). The error_log is a ton of file does not exist errors of this type:

Code:
[Mon Jun 25 19:18:22 2012] [error] [client (IPRemoved)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
[Mon Jun 25 19:18:26 2012] [error] [client (IP_Removed)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
[Mon Jun 25 19:18:31 2012] [error] [client (IP_Removed)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
[Mon Jun 25 19:18:33 2012] [error] [client (IP_Removed)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
[Mon Jun 25 19:18:35 2012] [error] [client (IP_Removed)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico

gabriot 06-25-2012 06:38 PM
That last error should be fixed now I placed a 16x16 icon file in that directory


All times are GMT -5. The time now is 01:48 PM.