LinuxQuestions.org
Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 06-25-2012, 05:59 PM   #1
gabriot
LQ Newbie
 
Registered: Jun 2012
Posts: 12

Rep: Reputation: Disabled
lt-httpd (Apache I believe) and sshd combining to take up 100% CPU


I don't believe it is a DoS attack because when I run "last" all I see are logins from me and running "cat /var/log/messages | grep ssh" comes up with nothing.

I figure perhaps I should restart apache? Here's a ps aux | grep httpd
Code:
ps aux | grep httpd
root     10712  0.0  0.5  58768 10548 ?        Ss   Apr17   0:01 /usr/sbin/.libs/lt-httpd
apache   11512  0.0  0.7  63388 15876 ?        S    Jun24   0:14 /usr/sbin/.libs/lt-httpd
apache   11973  0.0  0.7  63496 15588 ?        S    Jun24   0:13 /usr/sbin/.libs/lt-httpd
root     19560  7.8  0.2  62036  5532 ?        R    Jun24 182:04 /usr/sbin/.libs/lt-httpd
apache   26224  0.0  0.7  63248 15616 ?        S    10:08   0:07 /usr/sbin/.libs/lt-httpd
apache   26235  0.0  0.7  63236 15544 ?        S    10:08   0:08 /usr/sbin/.libs/lt-httpd
apache   26634  0.0  0.6  63356 13404 ?        S    18:29   0:00 /usr/sbin/.libs/lt-httpd
apache   26635  0.0  0.6  63188 12880 ?        S    18:29   0:00 /usr/sbin/.libs/lt-httpd
apache   26636  0.0  0.6  62652 12980 ?        S    18:29   0:00 /usr/sbin/.libs/lt-httpd
root     28787  0.0  0.0   3888   680 pts/0    S+   18:59   0:00 grep httpd
apache   29514  0.0  0.7  63284 15404 ?        S    10:59   0:07 /usr/sbin/.libs/lt-httpd
apache   29550  0.0  0.7  63500 15368 ?        S    11:00   0:07 /usr/sbin/.libs/lt-httpd
apache   29651  0.0  0.7  63392 15756 ?        S    11:02   0:07 /usr/sbin/.libs/lt-httpd
apache   29662  0.0  0.7  63396 15216 ?        S    11:02   0:07 /usr/sbin/.libs/lt-httpd
apache   29666  0.0  0.7  63464 15344 ?        S    11:02   0:07 /usr/sbin/.libs/lt-httpd
apache   29672  0.0  0.7  63336 15528 ?        S    11:02   0:07 /usr/sbin/.libs/lt-httpd
apache   29674  0.0  0.7  63320 15220 ?        S    11:02   0:07 /usr/sbin/.libs/lt-httpd
apache   29678  0.0  0.7  63388 15420 ?        S    11:02   0:06 /usr/sbin/.libs/lt-httpd
apache   29720  0.0  0.7  63640 15912 ?        S    11:03   0:06 /usr/sbin/.libs/lt-httpd
apache   29729  0.0  0.7  62692 15064 ?        S    11:03   0:07 /usr/sbin/.libs/lt-httpd
apache   29767  0.0  0.7  63332 15800 ?        S    11:03   0:07 /usr/sbin/.libs/lt-httpd
apache   29781  0.0  0.7  63192 15560 ?        S    11:04   0:06 /usr/sbin/.libs/lt-httpd
apache   30467  0.0  0.7  63492 16504 ?        S    Jun24   0:23 /usr/sbin/.libs/lt-httpd
apache   30734  0.0  0.7  63396 15272 ?        S    11:18   0:07 /usr/sbin/.libs/lt-httpd
apache   30935  0.0  0.7  63492 15632 ?        S    11:20   0:07 /usr/sbin/.libs/lt-httpd
apache   30936  0.0  0.7  63400 15328 ?        S    11:20   0:07 /usr/sbin/.libs/lt-httpd
apache   31978  0.0  0.7  63344 15716 ?        S    11:38   0:06 /usr/sbin/.libs/lt-httpd
apache   31980  0.0  0.7  63392 15752 ?        S    11:38   0:06 /usr/sbin/.libs/lt-httpd
apache   31984  0.0  0.7  63388 15436 ?        S    11:38   0:07 /usr/sbin/.libs/lt-httpd
apache   31986  0.0  0.7  62864 14764 ?        S    11:38   0:06 /usr/sbin/.libs/lt-httpd
apache   31987  0.0  0.7  63456 15552 ?        S    11:38   0:06 /usr/sbin/.libs/lt-httpd
apache   32195  0.0  0.7  63352 15644 ?        S    11:40   0:06 /usr/sbin/.libs/lt-httpd
apache   32234  0.0  0.7  63404 15420 ?        S    11:41   0:06 /usr/sbin/.libs/lt-httpd
apache   32279  0.0  0.7  63248 15372 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32293  0.0  0.7  63380 15164 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32294  0.0  0.7  62868 15228 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32295  0.0  0.7  63492 15612 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32329  0.0  0.7  63492 15484 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32334  0.0  0.7  63168 15152 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32340  0.0  0.7  63492 15364 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32343  0.0  0.7  63316 15528 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32346  0.0  0.7  62948 15516 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
 
Old 06-25-2012, 06:12 PM   #2
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.9, Centos 7.3
Posts: 17,396

Rep: Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395
Rather than do that, I'd look into the apache access_log and error_log. According to this http://slack-linux.blogspot.com.au/2...ate-codes.html the processes are all waiting for an event ...
Also, check the /var/log/mesages by eye, don't grep for ssh.
 
Old 06-25-2012, 06:22 PM   #3
gabriot
LQ Newbie
 
Registered: Jun 2012
Posts: 12

Original Poster
Rep: Reputation: Disabled
I checked the messages file by eye and just saw my own login successes.

The access_log is full of a ton of different lines (that I unfortunately probably should not post into here for security reasons, but it more or less looks to be doing what it "should" be doing). The error_log is a ton of file does not exist errors of this type:

Code:
[Mon Jun 25 19:18:22 2012] [error] [client (IPRemoved)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
[Mon Jun 25 19:18:26 2012] [error] [client (IP_Removed)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
[Mon Jun 25 19:18:31 2012] [error] [client (IP_Removed)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
[Mon Jun 25 19:18:33 2012] [error] [client (IP_Removed)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
[Mon Jun 25 19:18:35 2012] [error] [client (IP_Removed)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
 
Old 06-25-2012, 06:38 PM   #4
gabriot
LQ Newbie
 
Registered: Jun 2012
Posts: 12

Original Poster
Rep: Reputation: Disabled
That last error should be fixed now I placed a 16x16 icon file in that directory
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
OpenOffice/LibreOffice writer uses 100% CPU time, 100% memory, workaround someone? jlinkels Linux - Software 11 08-30-2012 01:50 PM
Apache 100% CPU load UnrealX Linux - Server 8 02-04-2011 08:04 AM
100% cpu usage by apache user yilmaz Linux - Newbie 5 11-12-2009 04:33 PM
Squid & apache = 100% cpu teamfj Linux - Networking 3 05-27-2009 12:20 AM
Apache httpd taking 99% CPU Usage nimish Linux - Software 1 11-04-2004 06:49 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 04:27 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration