ps aux
Code:
root 1 0.0 0.2 1920 532 ? Ss May26 0:00 /sbin/init
root 2 0.0 0.0 0 0 ? S May26 0:00 [migration/0]
root 3 0.0 0.0 0 0 ? SN May26 0:00 [ksoftirqd/0]
root 4 0.0 0.0 0 0 ? S< May26 0:00 [events/0]
root 5 0.0 0.0 0 0 ? S< May26 0:00 [khelper]
root 6 0.0 0.0 0 0 ? S< May26 0:00 [kthread]
root 7 0.0 0.0 0 0 ? S< May26 0:00 [xenwatch]
root 8 0.0 0.0 0 0 ? S< May26 0:00 [xenbus]
root 14 0.0 0.0 0 0 ? S< May26 0:00 [kblockd/0]
root 16 0.0 0.0 0 0 ? S< May26 0:00 [kseriod]
root 59 0.0 0.0 0 0 ? S< May26 0:00 [kswapd0]
root 60 0.0 0.0 0 0 ? S< May26 0:00 [aio/0]
root 61 0.0 0.0 0 0 ? S< May26 0:00 [xfslogd/0]
root 62 0.0 0.0 0 0 ? S< May26 0:00 [xfsdatad/0]
root 202 0.0 0.0 0 0 ? S< May26 0:00 [kjournald]
root 347 0.0 0.1 2236 348 ? S<s May26 0:00 /sbin/udevd --daemon
syslog 1119 0.0 0.2 1952 616 ? Ss May26 0:00 /sbin/syslogd -a /var/lib/named/dev/log -u syslog
root 1140 0.0 0.1 1888 420 ? S May26 0:00 /bin/dd bs 1 if /proc/kmsg of /var/run/klogd/kmsg
klog 1142 0.0 0.1 2152 384 ? Ss May26 0:00 /sbin/klogd -P /var/run/klogd/kmsg
ntp 1173 0.0 0.3 4136 912 ? Ss May26 0:00 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 110:112 -g
root 1222 0.0 1.3 6888 3440 ? Ss May26 0:01 /usr/sbin/openvpn --writepid /var/run/openvpn.server.pid --daemon ovpn-server --cd /etc/open
root 1241 0.0 0.2 5328 632 ? Ss May26 0:00 /usr/sbin/sshd
root 1302 0.0 0.4 2784 1068 ? S May26 0:00 /bin/sh /usr/bin/mysqld_safe
mysql 1344 0.0 4.0 130572 10496 ? Sl May26 0:06 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/my
root 1346 0.0 0.1 1712 472 ? S May26 0:00 logger -p daemon.err -t mysqld_safe -i -t mysqld
root 1413 0.0 0.1 1920 356 ? S May26 0:00 /usr/sbin/courierlogger -pid=/var/run/courier/authdaemon/pid -start /usr/lib/courier/courier
root 1414 0.0 0.1 2084 456 ? S May26 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 1439 0.0 0.1 1920 284 ? S May26 0:00 /usr/sbin/courierlogger -pid=/var/run/courier/imapd.pid -start -name=imapd /usr/sbin/courier
root 1440 0.0 0.1 2024 464 ? S May26 0:00 /usr/sbin/couriertcpd -address=0 -maxprocs=40 -maxperip=20 -nodnslookup -noidentlookup 143 /
root 1461 0.0 0.1 1920 284 ? S May26 0:00 /usr/sbin/courierlogger -pid=/var/run/courier/imapd-ssl.pid -start -name=imapd-ssl /usr/sbin
root 1462 0.0 0.1 2020 464 ? S May26 0:00 /usr/sbin/couriertcpd -address=0 -maxprocs=40 -maxperip=20 -nodnslookup -noidentlookup 993 /
root 1466 0.0 0.2 2300 588 ? S May26 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 1467 0.0 0.2 2300 588 ? S May26 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 1468 0.0 0.2 2300 588 ? S May26 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 1469 0.0 0.2 2300 588 ? S May26 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 1470 0.0 0.2 2300 556 ? S May26 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 1482 0.0 0.1 1920 428 ? S May26 0:00 /usr/sbin/courierlogger -pid=/var/run/courier/pop3d.pid -start -name=pop3d /usr/sbin/courier
root 1483 0.0 0.2 2024 540 ? S May26 0:00 /usr/sbin/couriertcpd -maxprocs=40 -maxperip=4 -nodnslookup -noidentlookup -address=0 110 /u
root 1504 0.0 0.1 1920 284 ? S May26 0:00 /usr/sbin/courierlogger -pid=/var/run/courier/pop3d-ssl.pid -start -name=pop3d-ssl /usr/sbin
root 1505 0.0 0.1 2024 464 ? S May26 0:00 /usr/sbin/couriertcpd -address=0 -maxprocs=40 -maxperip=4 -nodnslookup -noidentlookup 995 /u
ossecm 1539 0.0 0.5 3068 1416 ? S May26 0:00 /var/ossec/bin/ossec-maild
root 1543 0.0 0.1 1992 388 ? S May26 0:00 /var/ossec/bin/ossec-execd
ossec 1547 0.0 0.8 13124 2184 ? Sl May26 0:02 /var/ossec/bin/ossec-analysisd
root 1552 0.0 0.1 1864 432 ? S May26 0:00 /var/ossec/bin/ossec-logcollector
root 1556 0.0 0.3 2064 892 ? S May26 0:23 /var/ossec/bin/ossec-syscheckd
ossec 1560 0.0 0.2 2048 612 ? S May26 0:00 /var/ossec/bin/ossec-monitord
root 1693 0.0 0.1 7880 368 ? Ss May26 0:00 /usr/sbin/saslauthd -a pam -c -m /var/spool/postfix/var/run/saslauthd -r -n 5
root 1694 0.0 0.2 9036 776 ? S May26 0:00 /usr/sbin/saslauthd -a pam -c -m /var/spool/postfix/var/run/saslauthd -r -n 5
root 1695 0.0 0.0 7880 32 ? S May26 0:00 /usr/sbin/saslauthd -a pam -c -m /var/spool/postfix/var/run/saslauthd -r -n 5
root 1699 0.0 0.0 7880 164 ? S May26 0:00 /usr/sbin/saslauthd -a pam -c -m /var/spool/postfix/var/run/saslauthd -r -n 5
root 1700 0.0 0.0 7880 108 ? S May26 0:00 /usr/sbin/saslauthd -a pam -c -m /var/spool/postfix/var/run/saslauthd -r -n 5
root 1847 0.0 0.2 2116 748 ? Ss May26 0:00 /usr/sbin/cron
root 1927 0.0 1.0 6920 2772 ? Ss May26 0:00 /usr/sbin/munin-node
root 2105 0.0 0.3 14488 928 ? Ss May26 0:00 /root/ispconfig/httpd/bin/ispconfig_httpd -DSSL
root 2106 0.0 0.4 2812 1188 ? S May26 0:00 /bin/bash /root/ispconfig/sv/ispconfig_wconf
2003 2115 0.0 0.2 15176 616 ? S May26 0:00 /root/ispconfig/httpd/bin/ispconfig_httpd -DSSL
bind 2454 0.0 0.9 37560 2388 ? Ssl May26 0:00 /usr/sbin/named -u bind -t /var/lib/named
2003 2494 0.0 0.3 2924 1028 ? Ss May26 0:00 /home/admispconfig/ispconfig/tools/clamav/bin/freshclam -d -c 10 --datadir=/home/admispconfi
root 2500 0.0 0.5 28996 1440 ? Sl May26 0:01 /usr/sbin/monit -d 60 -c /etc/monit/monitrc -s /var/lib/monit/monit.state
root 2529 0.0 0.1 1728 432 tty1 Ss+ May26 0:00 /sbin/getty 38400 tty1
2003 5231 0.0 0.2 14956 624 ? S May26 0:00 /root/ispconfig/httpd/bin/ispconfig_httpd -DSSL
root 8644 0.0 1.3 43740 3484 ? Ss May26 0:00 /usr/sbin/apache2 -k start
root 8645 0.0 0.1 1772 472 ? S May26 0:00 /root/ispconfig/cronolog --symlink=/var/log/httpd/ispconfig_access_log /var/log/httpd/ispcon
root 12779 0.0 0.0 0 0 ? S May26 0:00 [pdflush]
root 21936 0.0 0.0 0 0 ? S May26 0:00 [pdflush]
root 19752 0.0 0.1 49284 388 ? Ssl May26 0:00 /usr/sbin/freeradius
www-data 31679 0.0 5.2 49480 13692 ? S May27 0:07 /usr/sbin/apache2 -k start
snort 11205 0.0 23.1 185124 60716 ? Ssl May27 0:07 /usr/sbin/snort -m 027 -D -d -l /var/log/snort -u snort -g snort -c /etc/snort/snort.conf -S
www-data 16886 0.0 6.0 49728 15968 ? S May27 0:07 /usr/sbin/apache2 -k start
www-data 22669 0.0 4.3 45520 11308 ? S May27 0:05 /usr/sbin/apache2 -k start
www-data 22671 0.0 5.6 48868 14928 ? S May27 0:05 /usr/sbin/apache2 -k start
www-data 19323 0.0 6.0 49696 15900 ? S May27 0:02 /usr/sbin/apache2 -k start
www-data 19324 0.0 5.6 49092 14856 ? S May27 0:02 /usr/sbin/apache2 -k start
www-data 20521 0.0 5.7 48860 15164 ? S May27 0:03 /usr/sbin/apache2 -k start
www-data 9852 0.0 4.0 44812 10716 ? S May27 0:01 /usr/sbin/apache2 -k start
proftpd 9980 0.0 0.6 9836 1612 ? Ss May27 0:00 proftpd: (accepting connections)
root 10051 0.0 0.6 5408 1760 ? Ss May27 0:00 /usr/lib/postfix/master
postfix 10063 0.0 0.6 5460 1804 ? S May27 0:00 qmgr -l -t fifo -u
postfix 10115 0.0 0.9 5784 2464 ? S May27 0:00 tlsmgr -l -t unix -u -c
www-data 18903 0.0 4.2 45500 11176 ? S 01:06 0:01 /usr/sbin/apache2 -k start
postfix 12245 0.0 0.6 5420 1712 ? S 04:44 0:00 pickup -l -t fifo -u -c
www-data 14595 0.0 3.7 44576 9788 ? S 05:00 0:00 /usr/sbin/apache2 -k start
postfix 17060 0.0 1.2 6448 3252 ? S 05:21 0:00 smtpd -n smtp -t inet -u -c -o stress -s 2
root 19551 0.0 1.4 11364 3716 ? Ss 05:43 0:00 sshd: root@pts/0
root 19555 0.0 0.6 2920 1628 pts/0 Ss 05:43 0:00 -bash
proftpd 19567 0.0 0.8 9836 2200 ? S 05:43 0:00 proftpd: (accepting connections)
root 19571 0.0 0.2 1864 532 ? S 05:44 0:00 sleep 10
root 19572 0.0 0.3 2380 920 pts/0 R+ 05:44 0:00 ps aux
crontab-l
Code:
30 00 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/logs.php &> /dev/null
59 23 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/ftp_logs.php &> /dev/null
59 23 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/mail_logs.php &> /dev/null
59 23 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/cleanup.php &> /dev/null
0 4 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/webalizer.php &> /dev/null
0,30 * * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/check_services.php &> /dev/null
15 3,15 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/quota_msg.php &> /dev/null
40 00 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/traffic.php &> /dev/null
05 02 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/backup.php &> /dev/null
0 4 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/awstats.php &> /dev/null
BTW, the behavior persists agter rebooting.
Could something else be updating hosts.deny, OSSEC, prelude, snort, prewikka perhaps?