Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > ISPConfig 2 > General

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Reply
 
Thread Tools Display Modes
  #1  
Old 23rd June 2010, 12:44
esezako esezako is offline
Senior Member
 
Join Date: Dec 2008
Posts: 176
Thanks: 16
Thanked 4 Times in 3 Posts
Default gam_server??

Hi, emails users of ispconfig are used to send spam days ago.

After change passwords of this users stop spam, but in top always appear this:

Code:
  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                        
11952 web26_au  20   0  2564 1136  984 S    0  0.0   0:00.00 gam_server                                                                                      
11956 web26_ba  20   0  2564 1132  984 S    0  0.0   0:00.00 gam_server                                                                                      
11974 web26_ba  20   0  3412 1024  836 S    0  0.0   0:00.12 imapd                                                                                           
12065 web26_au  20   0  3412 1040  840 S    0  0.0   0:00.10 imapd
what is gam_server?
is the server hacked?
Reply With Quote
Sponsored Links
  #2  
Old 23rd June 2010, 14:06
Mark_NL Mark_NL is offline
Senior Member
 
Join Date: Sep 2008
Location: The Netherlands
Posts: 912
Thanks: 12
Thanked 100 Times in 96 Posts
Default

From the website http://people.gnome.org/~veillard/gamin/
Quote:
Gamin is a file and directory monitoring system defined to be a subset of the FAM (File Alteration Monitor) system. This is a service provided by a library which allows to detect when a file or a directory has been modified.
Reply With Quote
  #3  
Old 23rd June 2010, 14:21
esezako esezako is offline
Senior Member
 
Join Date: Dec 2008
Posts: 176
Thanks: 16
Thanked 4 Times in 3 Posts
Default

OK, and why always this users are in top output?
Reply With Quote
  #4  
Old 23rd June 2010, 14:32
Mark_NL Mark_NL is offline
Senior Member
 
Join Date: Sep 2008
Location: The Netherlands
Posts: 912
Thanks: 12
Thanked 100 Times in 96 Posts
Default

You can always see those in top, since it's a process that's running .. :/
Reply With Quote
  #5  
Old 23rd June 2010, 14:43
esezako esezako is offline
Senior Member
 
Join Date: Dec 2008
Posts: 176
Thanks: 16
Thanked 4 Times in 3 Posts
Default

minimun 2 days
Reply With Quote
  #6  
Old 23rd June 2010, 19:43
esezako esezako is offline
Senior Member
 
Join Date: Dec 2008
Posts: 176
Thanks: 16
Thanked 4 Times in 3 Posts
Default

i kill this process but this reappear
Reply With Quote
  #7  
Old 24th June 2010, 09:36
Mark_NL Mark_NL is offline
Senior Member
 
Join Date: Sep 2008
Location: The Netherlands
Posts: 912
Thanks: 12
Thanked 100 Times in 96 Posts
Default

is it causing you problems then? You can just let it run ..
Reply With Quote
  #8  
Old 24th June 2010, 13:06
esezako esezako is offline
Senior Member
 
Join Date: Dec 2008
Posts: 176
Thanks: 16
Thanked 4 Times in 3 Posts
Default

But only appear process for users of web26 (i have > 200 sites) and not finished never.

Why?
Reply With Quote
  #9  
Old 24th June 2010, 15:00
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,747 Times in 2,578 Posts
Default

Is it maybe started by a cron job?
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
  #10  
Old 24th June 2010, 15:05
esezako esezako is offline
Senior Member
 
Join Date: Dec 2008
Posts: 176
Thanks: 16
Thanked 4 Times in 3 Posts
 
Default

i think not.

crontab -l

Code:
30 00 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/logs.php &> /dev/null
59 23 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/ftp_logs.php &> /dev/null
59 23 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/mail_logs.php &> /dev/null
59 23 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/cleanup.php &> /dev/null
0 4 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/webalizer.php &> /dev/null
0,30 * * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/check_services.php &> /dev/null
15 3,15 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/quota_msg.php &> /dev/null
40 00 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/traffic.php &> /dev/null
05 02 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/backup.php &> /dev/null
0 4 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/awstats.php &> /dev/null
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +2. The time now is 03:51.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.