So my fedora linux box is experiencing some slowdown under high traffic. I ran 'top' and noticed that there are six instances of mingetty running which got me thinking my machine might be compromised or something.

Is this typical? Do I really need to have mingetty instances running? I login via ssh frequently.

No, that's normal. It's for the six TTYs (ctrl+alt+F1-6 at the local machine).

AlucardZero is correct. Those are normal. However, you do not have to keep all 6. I usually remove all but 2 of them. I leave 1 and 2 just for grins just in case I hose my X configuration and for other command-line stuff.

You can remove unneeded ones by editing your /etc/inittab file. You would remove the runlevel number by the entries that you dont want to start.

Hope this helps

Saying it's normal is just a generic explanation. It might not reflect the actual situation. Next time you think something is compromised you will want to verify the running process is benign. For that you can check the location of the binary in /proc/$PID/exe (link to filesystem) and compare the hash of running 'md5sum' or 'sha1sum' against the /proc/$PID/exe against what your distro's package manager reports (if it has that capability), or use a file integrity checker like Aide, Samhain or even tripwire, Tiger (new version 3.2.2 out last august) or Rootkit Hunter (new 1.3.0 version only).

Thanks!

I watched the mail log for a bit and the machine seems fine. It's been up for 462 days now and there doesn't seem to be any extra mail traffic so I think it's ok.