Tracking Down A User
Mar 22, 2007
A user is running something that eats up all the server memory very quickly. Looking at the access logs this is all I get:
XX.XX.XX.XX - - [22/Mar/2007:12:58:06 -0400] "GET /index2.php?option=com_rss&feed=RSS1.0&no_html=1 HTTP/1.1" 403 -
XX.XX.XX.XX- - [22/Mar/2007:12:58:47 -0400] "GET /index2.php?option=com_rss&feed=RSS1.0&no_html=1 HTTP/1.1" 403 -
XX.XX.XX.XX - - [22/Mar/2007:12:58:58 -0400] "GET /index2.php?option=com_rss&feed=RSS1.0&no_html=1 HTTP/1.1" 403 -
Now there are quite a few index2.php's located on my server so I can not figure out who is running this. When I run ps ax -o pid,user,rss,command|grep httpd
I get about 20-30 of these:
13808 nobody 17360 /usr/local/apache/bin/httpd -DSSL
how I can figure out where this script is being run from?
View 2 Replies
ADVERTISEMENT
Nov 3, 2009
Recently, there are a lot of "apache" processes hogging my Cpanel server with the default owner "nobody". How could I track the apache process back to which user is using it?
View 8 Replies
View Related
May 28, 2008
I've lots of:
[warn] RewriteCond: NoCase option for non-regex pattern '-f' is not supported and will be ignored.
[warn] RewriteCond: NoCase option for non-regex pattern '-d' is not supported and will be ignored.
Any ideas how to track them?
View 5 Replies
View Related
May 18, 2009
How can track and follow a process id.
For example i need to know what is following process:
14764 root 39 15 11712 9.8m 1668 R 20 0.1 0:14.22 perl
I need to know wich/where file used perl with process id 14764
View 6 Replies
View Related
May 13, 2008
I have a CentOS box here that is causing some strange load. Brand new X3230 (4*2.66Ghz), 2GB ram and 2*500GB SATA2 in raid-1 on a LSI MegaIDE controller.
Basically the server is continuesly at a load of 1. However I dont see why. No CPU load, and no IO as far as I can see. Does anybody have a tip where to look for the problem?
Quote:
top - 05:01:56 up 1:53, 2 users, load average: 1.00, 1.02, 1.20
Tasks: 81 total, 1 running, 80 sleeping, 0 stopped, 0 zombie
Cpu0 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu1 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu2 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu3 : 0.3%us, 0.0%sy, 0.0%ni, 99.7%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 2072132k total, 591072k used, 1481060k free, 65652k buffers
Swap: 2048276k total, 0k used, 2048276k free, 461532k cached
Quote:
# iostat
Linux 2.6.18-53.el5 (xxxx.xandrios.net) 05/14/2008
avg-cpu: %user %nice %system %iowait %steal %idle
2.65 0.56 5.56 0.97 0.00 90.26
Device: tps Blk_read/s Blk_wrtn/s Blk_read Blk_wrtn
sda 6.44 99.67 255.89 686581 1762792
Quote:
# hdparm -tT /dev/sda
/dev/sda:
Timing cached reads: 16092 MB in 2.00 seconds = 8057.39 MB/sec
Timing buffered disk reads: 88 MB in 3.04 seconds = 28.92 MB/sec
With the WHT benchmark test the machine scores about 520 points, seems not bad either.
Only thing I could think of is that it has something to do with the raidcard. The data transfer rate is quite low. Could it be that the card is rebuilding the array? Can I check that without rebooting?
View 8 Replies
View Related
Jan 9, 2009
Does anyone knows if ubercart has embended affiliate tracking capabilities? Do you know if any other open source e-shop has this feature? Could you suggest something you know from experience or heard of?
View 0 Replies
View Related
Jan 13, 2009
software for tracking the bandwidth usage on servers? It would be nice if there is one that has a web interface and the ability to add multiple different servers for tracking. Looking for something that runs on Linux (CentOS in particular).
View 6 Replies
View Related
May 24, 2008
I have a few questions about emails. I have root access to the server in question.
1.) I have a spammer on my server and i'm having trouble tracking him down. Anyone have any suggestions?
2.) I'm using cPanel and WHM is there any way to track by account how many emails there sending?
View 2 Replies
View Related
Jan 10, 2007
We have received the complain from paypal that one of the domains were phishing. How to track it down? How to find out the method that how they uploaded? I checked /tmp file and couldn't find anything. I check access_log file for wget and couldnt find anyting.
View 2 Replies
View Related
Mar 26, 2007
I just finished an information website and my corporation is now asking if there's a way to track the most popular pages on the site. Is there a way to do this with a pre-built function in MySQL or will we need to build a module? I have no experience working with MySQL or ASP.NET; as a purely client-side designer I want to be able to help but I'm at my limit.
View 1 Replies
View Related
Jul 20, 2007
I have Awstats on my server enabled for:
Nokia Browser (PDA/Phone Browser)
UP.Browser (PDA/Phone Browser)
Motorola Browser (PDA/Phone Browser)
My question is, are the visitors a day accurate - which I take to be uniques. It seems these must be pretty far off.
Presently they show an extremely high multiple of that for pages/s (approx 30 -50 times the visitors). I've never heard of visitors clicking this many pages.
I've not come across these kind of number with other non-mobile sites and it makes wonder if its right.
A) is tracking handled in the same way on mobile devices as on desktops (cookies or sessions?) And is this reliable for mobile/handheld/cell-phone devices?
B) There really isn't much of a chance of these page views being a result of bookmarks - the page views don't seem to add up to this.
The 'Browser Top 10' hits coming from 'unknown' are > 50% of the total amount.
Are there any quirks with awstats or other tracking software when it comes to mobile devices, even though the activity is taking place on the server? I take it Urchin may be more accurate?
View 0 Replies
View Related
Apr 9, 2007
I am using Yahoo Webservice API.
[url]
Recently I found out that I often hit the 5000 search per day limit.
I think I found a way to track usage of my Application ID with it. I want to know which IP has been using my APPID, for example.
However, I forget how.
Is this possible?
View 4 Replies
View Related
Dec 11, 2007
My company is just getting into web hosting. We currently have 10-15 sites that we are hosting. What do you guys use to keep track of all the details for the site (location, company info, etc). We're using a homegrown filemaker database atm, but we don't want to continue using this when we get 50+ sites. It doesn't matter if its web-based or a standalone program.
View 6 Replies
View Related
Jul 12, 2007
Is there a good service for tracking server uptime (and therefore, downtime)?
View 4 Replies
View Related
Dec 11, 2014
We need to add visitor tracking code to the Control panel so we know who's using it and we can prompt inline chat etc. for support, but where to start.
The code is a mixture of Div tags and Java script.
How we can add this as there is no common footer file to drop the code in to.
View 2 Replies
View Related
May 7, 2007
I thought I knew enough about my .htaccess stuff to do this, but I can't seem to work it out. What I want to do is if a user visits domain.com/folder, we check to see if the folder exists. If so, show as normal (IE domain.com/support)
If a user visits domain.com/dynamicusername (dynamicusername is not a physical folder), redirect to dynamicusername.domain.com
View 3 Replies
View Related
Jan 3, 2014
when I find the subscription from the admin side of PPA, if I select "Login as user" I've noticed that it is different from actually logging in as the user - for example - "add domain alias" is missing when I login as a customer - but not as an admin... I need my customers to add their own aliases and manage them - how do I add that feature to the client login side?
View 9 Replies
View Related
Aug 13, 2008
use "nobody" is using 2much cpu on my server ... can someone explain me how is this possible ?
[url]
I already have checked
"Prevent the user "nobody" from sending out mail to remote addresses (PHP and CGI scripts generally run as nobody if you are not using PHPSuexec and Suexec respectively.)"
In tweak settings.
View 7 Replies
View Related
Aug 6, 2008
when I run top command I should see who user are running and I see only my root and no body
2840 mysql 15 0 181m 78m 4568 S 22 1.0 1102:41 mysqld
4078 nobody 16 0 37128 17m 3300 S 5 0.2 0:00.99 httpd
4032 nobody 15 0 37600 18m 3364 S 5 0.2 0:00.35 httpd
3541 nobody 17 0 38200 18m 3300 S 4 0.2 0:00.73 httpd
3598 nobody 16 0 41744 21m 3288 S 4 0.3 0:01.26 httpd
3738 nobody 15 0 39820 19m 3276 S 3 0.2 0:00.63 httpd
4052 nobody 15 0 38436 18m 3376 S 2 0.2 0:01.63 httpd
3428 nobody 15 0 37040 17m 3388 S 2 0.2 0:00.60 httpd
3806 nobody 17 0 38404 18m 3316 S 2 0.2 0:00.70 httpd
4036 nobody 15 0 38408 18m 3300 S 1 0.2 0:00.52 httpd
4072 nobody 15 0 44216 24m 3424 S 1 0.3 0:01.03 httpd
3402 nobody 15 0 38296 18m 3320 S 0 0.2 0:01.05 httpd
3437 nobody 15 0 41632 22m 3616 S 0 0.3 0:01.25 httpd
3505 nobody 15 0 37412 17m 3428 S 0 0.2 0:00.89 httpd
3523 nobody 15 0 41432 21m 3252 S 0 0.3 0:00.30 httpd
3542 nobody 15 0 42720 22m 3388 S 0 0.3 0:00.88 httpd
3581 nobody 15 0 37464 17m 3272 S 0 0.2 0:00.40 httpd
3602 nobody 15 0 38472 18m 3420 S 0 0.2 0:00.31 httpd
3643 nobody 15 0 37788 18m 3308 S 0 0.2 0:00.50 httpd
3644 nobody 15 0 35120 15m 3000 S 0 0.2 0:00.03 httpd
3645 nobody 15 0 41816 21m 3276 S 0 0.3 0:00.52 httpd
3647 nobody 15 0 42908 23m 3408 S 0 0.3 0:01.20 httpd
3723 nobody 15 0 36260 16m 3408 S 0 0.2 0:00.85 httpd
3805 nobody 15 0 37512 17m 3272 S 0 0.2 0:00.44 httpd
4046 nobody 15 0 39596 19m 3284 S 0 0.2 0:01.41 httpd
4567 root 15 0 2452 1224 796 R 0 0.0 0:01.04 top
7826 root 15 0 0 0 0 S 0 0.0 0:06.21 pdflush
10001 root 15 0 12920 8528 1292 S 0 0.1 0:18.65 lfd
1 root 16 0 2060 636 544 S 0 0.0 0:12.09 init
2 root RT 0 0 0 0 S 0 0.0 0:01.15 migration/0
3 root 34 19 0 0 0 S 0 0.0 0:00.14 ksoftirqd/0
4 root RT 0 0 0 0 S 0 0.0 0:00.00 watchdog/0
5 root RT 0 0 0 0 S 0 0.0 0:00.63 migration/1
6 root 34 19 0 0 0 S 0 0.0 0:00.09 ksoftirqd/1
7 root RT 0 0 0 0 S 0 0.0 0:00.00 watchdog/1
8 root RT 0 0 0 0 S 0 0.0 0:01.29 migration/2
9 root 34 19 0 0 0 S 0 0.0 0:00.18 ksoftirqd/2
----------------------
and I can't know who are runing in my server
View 10 Replies
View Related
Dec 19, 2007
which user should i use when you doing work on the server? I've been login as root when i need to do work on the server (i know this is really bad.)
Should i create another user to ssh in and when i need to do crital stuff i will use su ?
What groupid should i set this user to?
View 14 Replies
View Related
Jul 9, 2009
I am currently looking for a new IP KVM. Right now I use a mix of HP and Raritan KVMs and I'm honestly not super happy with either of them. The main feature I'm looking for is the ability to setup multiple users and only allow them to access certain ports/devices on the KVM.
What would be the best IP KVM to look at for this?
View 10 Replies
View Related
Oct 8, 2009
I basically have a script that uses passthru when people login with FTP so it can connect users from multiple interfaces.
Thing is, it uses the default php.ini file so, to get this script to work I have to enable passthru in the default php.ini file, affecting all users with an account. I am currently running SuExec and can change the php.ini file each user uses from httpd.conf. But as far as I am aware the FTP user isn't in httpd.conf.
What user does FTP run under and how can I use a custom php.ini file just for the FTP daemon. Also, as a side note, what are the effects of passthru and can it be used for malicious intent if wanted?
View 0 Replies
View Related
Jul 27, 2009
Is it possible to create user aliases on linux?
I have webmin and virtualmin running on my server, but it's set up to create usernames in the form name@domain.tld.
Is it possible to create an alias, say myname that points to myname@mydomain.tld, so that I am able to have certain users to login via SSH using a shorter name?
View 1 Replies
View Related
Jun 17, 2009
i want to create a vps for tunnel ip for some user that use socks proxy.
how can i do it ?
our os is Centos
View 2 Replies
View Related
May 5, 2009
when I tried to reboot my VPS via Hypervm Enterprise I got this error:
===========
Alert: The vps myvps.vm is locked by another user. This would also be because you had interrupted an earlier activity that would take long time to complete. HyperVM has waited 15 seconds for the other process to finish. Please try after sometime.
===========
and memory usage going crazy it's going from 400MB "natural usage level" to 1024MB then the vps and all sites going down.
View 4 Replies
View Related
Jan 19, 2008
How to list how many inodes is using some user or all users for a Linix system?
View 4 Replies
View Related
Oct 20, 2008
how i can make an FTP account for my clients to upload files to
but when they upload a file they dont see it after. I want to just make 1 ftp user / pass to give to my clients but after uploading they dont see the file or any other files in the folder.
Maybe a way for the file to auto move to another folder after uploading?
View 8 Replies
View Related
Dec 19, 2008
I have CentOS 5.1, and I can create a new user to be added to the wheel, however it will not let me login directly through SSH.
The only way I can login as that user is to su - from the root account. I have checked, and the user is added to the wheel, and it does recognize the password when I su -.
Does anyone know what could be causing this? Is there some mundane step I missed?
View 2 Replies
View Related
Jun 12, 2008
I am running phpsuexec on the server and it seems all php.ini settings are being applied per directory, I would like to have them running per user.
View 6 Replies
View Related
