Portal Home > Knowledgebase > Articles Database > Lots of apache graceful commands in top, under attack?
Lots of apache graceful commands in top, under attack?
| Posted by chasebug, 11-13-2009, 11:29 AM |
| There are I think at least 50 of user nobody running command /usr/local/apache/bin/httpd -k graceful
Is this an attack?
When I killed them one by one, now I see lots of these commands run by nobody:
/usr/local/apache/bin/httpd -k start -DSSL
|
| Posted by madaboutlinux, 11-13-2009, 11:40 AM |
| nobody' is an Apache user and all those are the connections to your websites. 50 isn't a large figure, however, if you would like to check the status of Apache connections, use either of the 2 options (both will show the same result):
WHM >> Service Status >> Apache Status
OR
SSH to the server and execute:
lynx http://localhost/whm-server-status
To list and sort the IPs connecting to the Apache service, use the netstat command
|
| Posted by [x10]Corey, 11-13-2009, 01:01 PM |
| Are you running cPanel\WHM? If so, what version? There is an issue with 11.25 that caused tons of graceful restarts, downgrading to 11.24 fixed it for us.
|
| Posted by Hostwaresupport, 11-14-2009, 02:10 AM |
| You can check number of connections to apache server by using following command.
netstat -anp | grep 80 | wc -l
If this number is too large then, it could be ddos on your server. Apart from this you can try corey's advice.
|
| Posted by inspiron, 11-14-2009, 08:28 AM |
| Yes, 50 of user nobody seems to be normal.
What is the load on the server?
|
| Posted by chasebug, 11-14-2009, 12:27 PM |
| Load is between 9 and 15
|
| Posted by keserhosting, 11-16-2009, 08:48 AM |
| Load between 9 to 15 doesn't seems to be fine. Its definitely sound like something nasty is happening on the server. Try to find what suspicious process are responsible for causing load. Use below command from more detail processes,
# ps auxf or # top
|
Add to Favourites 
Print this Article
Also Read
