LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   100% cpu usage by apache user (https://www.linuxquestions.org/questions/linux-newbie-8/100-cpu-usage-by-apache-user-745771/)

yilmaz 08-07-2009 04:31 AM

100% cpu usage by apache user
 
hello,

my server keeps getting clogged and i have no idea what i can do about it.

top says that the apache user is using 100% cpu with the "std" command.

ps -eo pcpu,pid,user,args | sort -r -k1 | head -10

Code:

%CPU PID USER COMMAND
99.4 28504 apache ./std 68.146.134.210 80

what could this be? looks like a hack to me, since the ip address is not ours. how can i resolve this in an easy way?

thanks

Simon Bridge 08-07-2009 04:45 AM

Have you searched your question?
http://forums.fedoraforum.org/archiv...p/t-96517.html
http://www.linuxquestions.org/questi...u-load-574826/

yilmaz 08-07-2009 04:51 AM

yes i did, but it all came back to httpd settings and i don't think that this is the same thing, right?

Simon Bridge 08-07-2009 06:13 AM

What have you done to verify that the suggested solutions are not appropriate to your situation?

yilmaz 08-07-2009 07:37 AM

i don't think it's Apache itself, but the user "apache" is being malused.

do you know what this means?
Code:

%CPU  PID    USER    COMMAND
99.4  28504  apache  ./std 68.146.134.210 80


Marbug 11-12-2009 04:33 PM

I had the same problem today

I'm running Gentoo on my server and someone tried this too
I'm still looking for a solution, but I think it will go in the way to format and reainstall everything

facts are:

I lost my internet conenction and found out that the problem was on my server
First this I did was checking htop for any weard stuff, and I found the same thing you did:
(I did want to past an image but the forum won't allow me :P)
there was also an ssh with pid 4897 which was running on port 443, and what stopped apache from restarting

Code:

#
# ps aux | grep 4897
#
root      4897  0.0  0.0  4416  928 ?        Ss  Nov07  0:00 /usr/sbin/sshd
#
root    22940  0.0  0.0  1768  488 pts/1    R+  20:18  0:00 grep --colour=auto 4897

Code:

#
# /etc/init.d/apache2 start
#
 * Starting apache2 ...
#
(98)Address already in use: make_sock: could not bind to address [::]:443
#
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:443
#
no listening sockets available, shutting down
#
Unable to open logs

Code:

#
# netstat -apn | grep 443
#
tcp        0      0 127.0.0.1:81            127.0.0.1:54430        TIME_WAIT  -                 
#
tcp        0      0 127.0.0.1:81            127.0.0.1:54436        TIME_WAIT  -                 
#
tcp        0      0 127.0.0.1:81            127.0.0.1:54432        TIME_WAIT  -                 
#
tcp        0      0 127.0.0.1:81            127.0.0.1:54438        TIME_WAIT  -                 
#
tcp        0      0 127.0.0.1:81            127.0.0.1:54434        TIME_WAIT  -                 
#
tcp6      0      0 :::443                  :::*                    LISTEN    4897/sshd

similar problems:
http://www.webhostingtalk.com/showthread.php?t=633194
http://www.howtoforge.com/forums/arc...p/t-35173.html
http://search.code-head.com/F-100-cp...e-user-2051509


All times are GMT -5. The time now is 09:32 AM.