lt-httpd (Apache I believe) and sshd combining to take up 100% CPU

gabriot · 06-25-2012, 06:59 PM

I don't believe it is a DoS attack because when I run "last" all I see are logins from me and running "cat /var/log/messages | grep ssh" comes up with nothing.

I figure perhaps I should restart apache? Here's a ps aux | grep httpd

Code:

ps aux | grep httpd
root     10712  0.0  0.5  58768 10548 ?        Ss   Apr17   0:01 /usr/sbin/.libs/lt-httpd
apache   11512  0.0  0.7  63388 15876 ?        S    Jun24   0:14 /usr/sbin/.libs/lt-httpd
apache   11973  0.0  0.7  63496 15588 ?        S    Jun24   0:13 /usr/sbin/.libs/lt-httpd
root     19560  7.8  0.2  62036  5532 ?        R    Jun24 182:04 /usr/sbin/.libs/lt-httpd
apache   26224  0.0  0.7  63248 15616 ?        S    10:08   0:07 /usr/sbin/.libs/lt-httpd
apache   26235  0.0  0.7  63236 15544 ?        S    10:08   0:08 /usr/sbin/.libs/lt-httpd
apache   26634  0.0  0.6  63356 13404 ?        S    18:29   0:00 /usr/sbin/.libs/lt-httpd
apache   26635  0.0  0.6  63188 12880 ?        S    18:29   0:00 /usr/sbin/.libs/lt-httpd
apache   26636  0.0  0.6  62652 12980 ?        S    18:29   0:00 /usr/sbin/.libs/lt-httpd
root     28787  0.0  0.0   3888   680 pts/0    S+   18:59   0:00 grep httpd
apache   29514  0.0  0.7  63284 15404 ?        S    10:59   0:07 /usr/sbin/.libs/lt-httpd
apache   29550  0.0  0.7  63500 15368 ?        S    11:00   0:07 /usr/sbin/.libs/lt-httpd
apache   29651  0.0  0.7  63392 15756 ?        S    11:02   0:07 /usr/sbin/.libs/lt-httpd
apache   29662  0.0  0.7  63396 15216 ?        S    11:02   0:07 /usr/sbin/.libs/lt-httpd
apache   29666  0.0  0.7  63464 15344 ?        S    11:02   0:07 /usr/sbin/.libs/lt-httpd
apache   29672  0.0  0.7  63336 15528 ?        S    11:02   0:07 /usr/sbin/.libs/lt-httpd
apache   29674  0.0  0.7  63320 15220 ?        S    11:02   0:07 /usr/sbin/.libs/lt-httpd
apache   29678  0.0  0.7  63388 15420 ?        S    11:02   0:06 /usr/sbin/.libs/lt-httpd
apache   29720  0.0  0.7  63640 15912 ?        S    11:03   0:06 /usr/sbin/.libs/lt-httpd
apache   29729  0.0  0.7  62692 15064 ?        S    11:03   0:07 /usr/sbin/.libs/lt-httpd
apache   29767  0.0  0.7  63332 15800 ?        S    11:03   0:07 /usr/sbin/.libs/lt-httpd
apache   29781  0.0  0.7  63192 15560 ?        S    11:04   0:06 /usr/sbin/.libs/lt-httpd
apache   30467  0.0  0.7  63492 16504 ?        S    Jun24   0:23 /usr/sbin/.libs/lt-httpd
apache   30734  0.0  0.7  63396 15272 ?        S    11:18   0:07 /usr/sbin/.libs/lt-httpd
apache   30935  0.0  0.7  63492 15632 ?        S    11:20   0:07 /usr/sbin/.libs/lt-httpd
apache   30936  0.0  0.7  63400 15328 ?        S    11:20   0:07 /usr/sbin/.libs/lt-httpd
apache   31978  0.0  0.7  63344 15716 ?        S    11:38   0:06 /usr/sbin/.libs/lt-httpd
apache   31980  0.0  0.7  63392 15752 ?        S    11:38   0:06 /usr/sbin/.libs/lt-httpd
apache   31984  0.0  0.7  63388 15436 ?        S    11:38   0:07 /usr/sbin/.libs/lt-httpd
apache   31986  0.0  0.7  62864 14764 ?        S    11:38   0:06 /usr/sbin/.libs/lt-httpd
apache   31987  0.0  0.7  63456 15552 ?        S    11:38   0:06 /usr/sbin/.libs/lt-httpd
apache   32195  0.0  0.7  63352 15644 ?        S    11:40   0:06 /usr/sbin/.libs/lt-httpd
apache   32234  0.0  0.7  63404 15420 ?        S    11:41   0:06 /usr/sbin/.libs/lt-httpd
apache   32279  0.0  0.7  63248 15372 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32293  0.0  0.7  63380 15164 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32294  0.0  0.7  62868 15228 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32295  0.0  0.7  63492 15612 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32329  0.0  0.7  63492 15484 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32334  0.0  0.7  63168 15152 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32340  0.0  0.7  63492 15364 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32343  0.0  0.7  63316 15528 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd
apache   32346  0.0  0.7  62948 15516 ?        S    11:42   0:06 /usr/sbin/.libs/lt-httpd

chrism01 · 06-25-2012, 07:12 PM

Rather than do that, I'd look into the apache access_log and error_log. According to this http://slack-linux.blogspot.com.au/2...ate-codes.html the processes are all waiting for an event ...
Also, check the /var/log/mesages by eye, don't grep for ssh.

gabriot · 06-25-2012, 07:22 PM

I checked the messages file by eye and just saw my own login successes.

The access_log is full of a ton of different lines (that I unfortunately probably should not post into here for security reasons, but it more or less looks to be doing what it "should" be doing). The error_log is a ton of file does not exist errors of this type:

Code:

[Mon Jun 25 19:18:22 2012] [error] [client (IPRemoved)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
[Mon Jun 25 19:18:26 2012] [error] [client (IP_Removed)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
[Mon Jun 25 19:18:31 2012] [error] [client (IP_Removed)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
[Mon Jun 25 19:18:33 2012] [error] [client (IP_Removed)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico
[Mon Jun 25 19:18:35 2012] [error] [client (IP_Removed)] File does not exist: [PathRemovedForSecurityReasons]/favicon.ico

gabriot · 06-25-2012, 07:38 PM

That last error should be fixed now I placed a 16x16 icon file in that directory