Discussion in 'General' started by skoena, Jun 24, 2012.
I have a huge cpu usage on PERL? What could be causing this?
Its a perl script running in one of your websites.
Is there a way to find out which script is causing this?
klogd -x is eating my CPU.
What can I do about it?
Try to find the program file with the find command, I guess it must be somwhere in /var/www or /tmp (not in /usr or other system directories). This is most likely a hcked or trojan script that uses the name of a common Linux application (klogd) to hide itself. But the real klogd would never run as www-data, so this fake program must be somewhere in one of your sites or in the tmp folder.
Tnx when the CPU is high again will try fo FIND it. (with "FIND KLOGD" right?)
Btw when I reboot the server the high usage and the klogd is stopped.
Linux is case sensitive, so the find command as well as the name of the application have to be in lowercase. See:
for all options of the find command.
Tried to find klogd but
"find: `klogd': No such file or directory"
This issue is not always running, 1 per 2 weeks this issue is there.
if it is malware then there is some kind of vulnerability to let it get uploaded and started. When you restart the process is not run on startup but the vulnerability is still there. It might be exploited again when the "hacker" realizes it is not running anymore.
Any tips for locating the script that is causing this?
Because "find klogd" is not working.
Do you have suexec enabled in all websites as recommended? When suexec is on, then the scripts of each website run under the user of the website so that you can locate the website which causes the issues by the username of the user that runs the script.
I enabled suexec for all sites but still I get this:
I'm still experiencing issues with KLOGD and hihg CPU usage.
Anybody tips for me?
Separate names with a comma.