100% cpu usage by apache user

yilmaz · 08-07-2009, 04:31 AM

hello,

my server keeps getting clogged and i have no idea what i can do about it.

top says that the apache user is using 100% cpu with the "std" command.

ps -eo pcpu,pid,user,args | sort -r -k1 | head -10

Code:

%CPU PID USER COMMAND
99.4 28504 apache ./std 68.146.134.210 80

what could this be? looks like a hack to me, since the ip address is not ours. how can i resolve this in an easy way?

thanks

Simon Bridge · 08-07-2009, 04:45 AM

Have you searched your question?
http://forums.fedoraforum.org/archiv...p/t-96517.html
http://www.linuxquestions.org/questi...u-load-574826/

yilmaz · 08-07-2009, 04:51 AM

yes i did, but it all came back to httpd settings and i don't think that this is the same thing, right?

Simon Bridge · 08-07-2009, 06:13 AM

What have you done to verify that the suggested solutions are not appropriate to your situation?

yilmaz · 08-07-2009, 07:37 AM

i don't think it's Apache itself, but the user "apache" is being malused.

do you know what this means?

Code:

%CPU   PID    USER     COMMAND
99.4   28504  apache   ./std 68.146.134.210 80

Marbug · 11-12-2009, 04:33 PM

I had the same problem today

I'm running Gentoo on my server and someone tried this too
I'm still looking for a solution, but I think it will go in the way to format and reainstall everything

facts are:

I lost my internet conenction and found out that the problem was on my server
First this I did was checking htop for any weard stuff, and I found the same thing you did:
(I did want to past an image but the forum won't allow me :P)
there was also an ssh with pid 4897 which was running on port 443, and what stopped apache from restarting

Code:

#
# ps aux | grep 4897
#
root      4897  0.0  0.0   4416   928 ?        Ss   Nov07   0:00 /usr/sbin/sshd
#
root     22940  0.0  0.0   1768   488 pts/1    R+   20:18   0:00 grep --colour=auto 4897

Code:

#
# /etc/init.d/apache2 start
#
 * Starting apache2 ...
#
(98)Address already in use: make_sock: could not bind to address [::]:443
#
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:443
#
no listening sockets available, shutting down
#
Unable to open logs

Code:

#
# netstat -apn | grep 443
#
tcp        0      0 127.0.0.1:81            127.0.0.1:54430         TIME_WAIT  -                   
#
tcp        0      0 127.0.0.1:81            127.0.0.1:54436         TIME_WAIT  -                   
#
tcp        0      0 127.0.0.1:81            127.0.0.1:54432         TIME_WAIT  -                   
#
tcp        0      0 127.0.0.1:81            127.0.0.1:54438         TIME_WAIT  -                   
#
tcp        0      0 127.0.0.1:81            127.0.0.1:54434         TIME_WAIT  -                   
#
tcp6       0      0 :::443                  :::*                    LISTEN     4897/sshd

similar problems:
http://www.webhostingtalk.com/showthread.php?t=633194
http://www.howtoforge.com/forums/arc...p/t-35173.html
http://search.code-head.com/F-100-cp...e-user-2051509