I've been getting a couple of interesting entries in my logwatch for the last couple of days. They all look something like this:
Apr 2 15:45:03 www proftpd[16706]: Unable to open password file /etc/passwd for reading: Too many open files in system I also get these entries here: (I'm not as worried about these, I think they're low mem problems) Apr 1 04:43:56 www kernel: VM: do_try_to_free_pages failed for lcdstop... Apr 2 04:47:27 www kernel: VM: do_try_to_free_pages failed for in.qpopper... Apr 2 04:47:27 www kernel: VM: do_try_to_free_pages failed for in.qpopper... Apr 2 04:47:53 www kernel: VM: do_try_to_free_pages failed for analog... The first time I noticed this problem was the other day, right after I accidentally caused an infinite loop with PHP and Apache. It pretty much disabled the server, but fortunately I was already logged in through SSH so I just had to restart apache. When that happened, nothing on the server was working. Now, I'm getting these entries only for ProFTP. the first one is at Apr 2 15:45:01 And the last one is at Apr 2 21:56:59 I'm getting ready to move off of this server, but I still need it for a couple more weeks. I checked for rootkits and didn't find anything. Any suggestions or comments? On a scale of 1-10, where 1 is "no problem-o," and 10 is "It's gonna blow!", where am I? Thanks in advance, Matt Nuzum _______________________________________________ cobalt-security mailing list [EMAIL PROTECTED] http://list.cobalt.com/mailman/listinfo/cobalt-security
