Gaps on graphs

[dinfiesta]

Please verify that you only have 1 cron entry on 1 user.

TheWitness

Only one cron running as root
Do not know what else to do...any sugestions?
I did change cmd.php (I read about it in one of your posts)

Maybe a problem with cron?

I get this: doing ps -furoot

root 7827 7825 0 16:45 ? 00:00:00 /bin/sh -c php /var/www/html/cacti/poller.php > /dev/null 2>&1
root 7828 7827 1 16:45 ? 00:00:00 php /var/www/html/cacti/poller.php

Perfoming a top I get this:

SER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
16564 apache 9 0 188 188 168 S 31.6 0.0 40:09 2 ssh-scan

Very strange...seems hangs...and eats lots of cpu!

Thanks

[TheWitness]

I don't know what ssh-scan is all about. Can't comment.

TheWitness

[TheWitness]

Ok, did some research. It looks like ssh-scan is a ssh-scanning utility. Should not be running as the apache user. I would suspect that your web server has been rooted and that the scanner was launched by the offending script.

I would turn up a Ethereal, pcap, nettle, etc. trace on your system to see what it's scanning and where the information is being sent before killing it however.

TheWitness

[dinfiesta]

I don't know what ssh-scan is all about. Can't comment.

TheWitness

Maybe because it running on a VPS ?