Did the /tmp check already earlier as well. Ps aux doesn't turn up anything unusual nor any /usr/local/httpd processes
The biggest thing I see is that if I let the /etc/cron.d/dfix.cron run, then it quickly contributes to several cced processes spawning in a short period. Whereas, if I prevent the cron job from running, kill the secondary cced processes, it appears to run without any spawning of these processes keeping the cpu down. On 3/16/11 11:45 PM, "Gerald Waugh" <[email protected]> wrote: > > On Wed, 2011-03-16 at 23:25 -0400, Abdul Rashid Abdullah wrote: >> Thanks. I tried that already. With the dfix and denyhosts running, it >> usually takes care of most of those automatically. In this case, I didn't >> find anything too excessive. Just the normal amount of activity. I am >> still stumped. > > Rashid, > > Are you sure the server hasn't been compromised? > scrutinize the files/directories in 'ls -la /tmp' > > > Also maybe look at 'ps aux' > and see if there might be processes '/usr/local/httpd' > > Gerald > > _______________________________________________ > Blueonyx mailing list > [email protected] > http://www.blueonyx.it/mailman/listinfo/blueonyx > _______________________________________________ Blueonyx mailing list [email protected] http://www.blueonyx.it/mailman/listinfo/blueonyx
