Hi all,

I'm having some difficulties with my Plesk Server

There is a process running calles Perl for over 3500 Minutes..
If i do "Kill 1169" it does nothing at all.. am i bieng hacked.. cause the process is using 95 Procent of my CPU!!
And how can i see wat the process is doing??
Can somebody plz help me???

Thnx!!! Grtzzzz

Top lis:

1169 apache 25 0 6740 2288 1144 R 96 0.1 3971:45 perl
14709 root 15 0 2172 1048 800 R 1 0.1 0:08.90 top
1 root 15 0 2044 576 548 S 0 0.0 0:03.17 init
2 root RT 0 0 0 0 S 0 0.0 0:15.38 migration/0
3 root 34 19 0 0 0 S 0 0.0 0:00.09 ksoftirqd/0
4 root RT 0 0 0 0 S 0 0.0 0:00.01 watchdog/0
5 root RT 0 0 0 0 S 0 0.0 0:08.22 migration/1
6 root 34 19 0 0 0 S 0 0.0 0:00.09 ksoftirqd/1
7 root RT 0 0 0 0 S 0 0.0 0:00.01 watchdog/1
8 root 10 -5 0 0 0 S 0 0.0 0:00.04 events/0
9 root 10 -5 0 0 0 S 0 0.0 0:00.09 events/1
10 root 10 -5 0 0 0 S 0 0.0 0:00.02 khelper
11 root 18 -5 0 0 0 S 0 0.0 0:00.02 kthread
15 root 10 -5 0 0 0 S 0 0.0 0:05.76 kblockd/0
16 root 10 -5 0 0 0 S 0 0.0 0:04.90 kblockd/1
17 root 16 -5 0 0 0 S 0 0.0 0:00.00 kacpid
74 root 12 -5 0 0 0 S 0 0.0 0:00.00 cqueue/0
75 root 12 -5 0 0 0 S 0 0.0 0:00.00 cqueue/1
78 root 13 -5 0 0 0 S 0 0.0 0:00.00 khubd
80 root 10 -5 0 0 0 S 0 0.0 0:00.03 kseriod
144 root 10 -5 0 0 0 S 0 0.0 1:05.32 kswapd0
145 root 11 -5 0 0 0 S 0 0.0 0:00.00 aio/0
146 root 11 -5 0 0 0 S 0 0.0 0:00.00 aio/1
295 root 12 -5 0 0 0 S 0 0.0 0:00.00 kpsmoused
337 root 13 -5 0 0 0 S 0 0.0 0:00.00 scsi_eh_0
344 root 12 -5 0 0 0 S 0 0.0 0:00.00 kmirrord
353 root 10 -5 0 0 0 S 0 0.0 3:45.23 kjournald
378 root 12 -5 0 0 0 S 0 0.0 0:00.00 kauditd
404 root 21 -4 2780 340 336 S 0 0.0 0:00.60 udevd
1049 root 20 -5 0 0 0 S 0 0.0 0:00.00 kmpathd/0
1050 root 10 -5 0 0 0 S 0 0.0 0:00.00 kmpathd/1
1074 root 11 -5 0 0 0 S 0 0.0 0:00.00 kjournald
1778 root 15 0 10220 5116 396 S 0 0.3 0:00.26 restorecond
1786 root 15 0 1704 580 492 S 0 0.0 2:08.20 syslogd
1789 root 15 0 1656 376 328 S 0 0.0 0:00.61 klogd
1798 root 18 0 1644 268 212 S 0 0.0 0:00.81 irqbalance
1811 root 18 0 2136 324 276 S 0 0.0 0:01.18 mcstransd
1826 rpc 15 0 1792 416 412 S 0 0.0 0:00.00 portmap
1844 root 15 0 1904 604 600 S 0 0.0 0:00.02 rpc.statd
1872 root 15 0 4944 280 248 S 0 0.0 0:00.03 rpc.idmapd
1884 dbus 15 0 13400 816 704 S 0 0.0 0:00.14 dbus-daemon
1893 root 17 0 2360 428 424 S 0 0.0 0:00.02 hcid
1897 root 17 0 1724 368 364 S 0 0.0 0:00.00 sdpd
1920 root 10 -10 0 0 0 S 0 0.0 0:00.00 krfcommd
1954 root 21 0 12700 480 428 S 0 0.0 0:00.14 pcscd
1970 root 17 0 1884 340 336 S 0 0.0 0:00.00 hidd
1983 root 25 0 12132 764 640 S 0 0.0 0:04.40 automount
2000 root 18 0 1656 436 432 S 0 0.0 0:00.00 acpid
2016 root 15 0 5184 684 588 S 0 0.0 0:00.04 sshd
2025 root 15 0 2684 760 668 S 0 0.0 1:18.43 xinetd
2046 root 15 0 5376 596 544 S 0 0.0 0:00.42 couriertcpd
2048 root 16 0 4220 620 568 S 0 0.0 0:00.40 courierlogger
2056 root 25 0 5376 536 532 S 0 0.0 0:00.01 couriertcpd
2058 root 25 0 4092 388 384 S 0 0.0 0:00.01 courierlogger

What does Apache provide?
What does 'lsof -w -n -p 1169' return?
If you 'netstat -ntp' does it show a lot of outbound connections?
What happens if you stop Apache completely?
Do your system and daemon logs show things you can't contribute to "usual" behaviour?

it returns this!
lsof -w -n -p 7629

perl 7629 apache 167w REG 253,0 0 24284892 /var/www/vhosts/kie vitboten.nl/statistics/logs/access_log
perl 7629 apache 168w REG 253,0 0 24284893 /var/www/vhosts/kie vitboten.nl/statistics/logs/access_ssl_log
perl 7629 apache 169w REG 253,0 8867 24284824 /var/www/vhosts/iyb g.com/statistics/logs/access_log
perl 7629 apache 170w REG 253,0 0 24284825 /var/www/vhosts/iyb g.com/statistics/logs/access_ssl_log
perl 7629 apache 171w REG 253,0 262 24221921 /var/www/vhosts/ham pton.nl/statistics/logs/access_log
perl 7629 apache 172w REG 253,0 142 24221909 /var/www/vhosts/dyb g.nl/statistics/logs/access_log
perl 7629 apache 173w REG 253,0 0 24221910 /var/www/vhosts/dyb g.nl/statistics/logs/access_ssl_log
perl 7629 apache 174w REG 253,0 0 24221672 /var/www/vhosts/dut chyachtbuildersgroup.com/statistics/logs/access_log
perl 7629 apache 175w REG 253,0 0 24221673 /var/www/vhosts/dut chyachtbuildersgroup.com/statistics/logs/access_ssl_log
perl 7629 apache 176w REG 253,0 65787 23004856 /var/www/vhosts/ams telvoorden.nl/statistics/logs/access_log
perl 7629 apache 177w REG 253,0 0 23004857 /var/www/vhosts/ams telvoorden.nl/statistics/logs/access_ssl_log
perl 7629 apache 178w REG 253,0 11051 22973151 /var/www/vhosts/num mer17.eu/statistics/logs/access_log
perl 7629 apache 179w REG 253,0 0 22973152 /var/www/vhosts/num mer17.eu/statistics/logs/access_ssl_log
perl 7629 apache 180w REG 253,0 13241 22939114 /var/www/vhosts/aut ocom.nl/statistics/logs/access_log
perl 7629 apache 181w REG 253,0 0 22939115 /var/www/vhosts/aut

As root, have you tried "kill -9 1169"... without specifying the signal number you are sending SIGTERM, which it could ignore. SIGKILL and SIGSTOP cannot be ignored, so at least try sending SIGKILL (number 9) before panicing.

You could also attempt to strace the perl process to see what it is spinning on. You would do this by running strace -p 1169, of course it's possible it's spinning in user space so strace could say nothing - in that case try ltrace.

It's not uncommon to have a perl process run away, perl will just do whatever the script says... unfortunately in your lsof output I don't see a perl script so it's probably an incomplete paste, otherwise we could look at the script to see what the problem is.

Apache supports resource limiting to put caps on how long something like this could go on, look into the RLimitCPU apache directive.

Hey by kill -9 the process leaves the list with no problem!
And my CPU is steady now!
only i could not find the RLimitCPU in the apache dir.
Al things are standing in /var/www/ , Am i'm looking right?

thnx!


Grtz,
Thijs

When I said "Directive" I did not mean an entry in a directory on the filesystem... rather I was referring to an Apache configuration directive. Look here:
http://httpd.apache.org/docs/2.0/mod...html#rlimitcpu

I had this same issue today. Tons of outbound traffic.

Does anyone know what could be causing this?
It is the exact same issue as above.

Thanks!

Jake

I have the same problem. When httpd start the cpu usage is 0.x% but more later number of httpd process is bigger and the cpu usage is bigger (60%)

i use the command lsof -p PID and show only many acces_log files open (access_log, error_log of all sites of server)


....
httpd 562 apache 224w REG 8,7 0 688164 /var/log/httpd/sitebuilder-access_log
httpd 562 apache 225w REG 8,7 0 689859 /var/log/httpd/ssl_access_log
httpd 562 apache 226w REG 8,7 0 689860 /var/log/httpd/ssl_request_log
httpd 562 apache 227u sock 0,5 306844858 can't identify protocol
httpd 562 apache 228r CHR 1,3 2150 /dev/null