SSH User Activity History
Sep 11, 2007Does CentOS4 logs every activity done by a SSH user? Or is there such script/software to do that?
View 10 Replies
ADVERTISEMENT
Limiting User Activity
Jul 29, 2007I am interested in setup user activity limits to avoid peaks on the server load, I have readen a lot about PAM and limits.conf but still have no idea on how set this limits. Most of the examples are similar to this page http://www.seifried.org/lasg/users/ but they are still confusing to me
>> I would like to setup rules like this:
Customers may not use more than 2% CPU daily, 3% memory daily, run more than 10 simultaneous processes per user, allow any process to run for longer than 30 CPU seconds, run any process that consumes more than 20% of available CPU at any time, or run any process that consumes more than 16 MB of memory.
How To Clear UNIX History Of User
Jan 4, 2007Can someone tell me how to clear the history of a UNIX user? For example, when logged in as a certain user I can press UP to see the last commands that were used. How can I get rid of them?
View 3 Replies View RelatedTrojan Activity - Running Perl With High CPU Usage, With User Apache
Sep 5, 2007Running programs named Perl with Heavy CPU usage, with the ownership of user apache.
We found the problem on Fedora 3 and Fedora 6.
In our case, it was the result of a Trojan activity.
Quick Solution
Check the cron jobs of user apache
crontab -u apache -e
*/1 * * * * perl /tmp/.tmp/tmpfile
delete the cronjob entry.
Also delete the file /tmp/.tmp/tmpfile
also added "apache" to the file /etc/cron.deny
That's all
Problem and solution in detail....
Log SSH Activity/ Keylogger
Oct 10, 2009I was just wondering is there any way to log SSH activity on server. or some sort of keylogger.
View 3 Replies View RelatedPossible To Change The History Counts?
Nov 18, 2008Is it possible to change the history counts? Just see, when i type history command on my machine, i get around 1000 last typed commands.
Is it possible to change that count ?
Remove History Command
Nov 25, 2008Is there any way so that i can remove a specific command from history.
628 ll
629 cat bash.sh
630 man mail
631 exit
632 history
You see my history command displays output as this. I need to remove the 630 th command.
Is this possible ?
I can use history -r but, it will remove all the commands executed in the session.
I need a command to remove a specific thing from history.
How To View History Log Of Server On WHM
Mar 14, 2007Is there a way to see what was happening on the server the last 24 hours for example in WHM ? A log or something.. To see if there was any high loads etc..
View 4 Replies View RelatedErasing The Form History
Jan 6, 2007I am interested in knowing how to get rid of all of my information from the computer. When i search for things, my old searches appear and thats not good cause I am at work I need to know how to get rid of the evidence. I tried the Tools >> Internet Options >> Delete Cookies - Delete Files and - Clear History but it still appears with all of my old searches. Why Why why? Note, this is not for the browzer, this is for a form such as the typing area on google.
View 3 Replies View RelatedHistory Shows Time
Mar 7, 2007I am working on a server, on that hostory shows in format like
Quote:
root@unix [/etc/profile.d]# history |more
1 Mar.04 01:35fdisk -l
2 Mar.04 01:35ping yahoo.com
3 Mar.04 01:35exit
4 Mar.04 18:21exit
5 Mar.04 18:04Smartctl -a dev/hda/
6 Mar.04 18:04Smartctl -a /dev/hda/
7 Mar.04 18:06Smartctl -a /dev/hda |grep Serial
That is history include time of command execution.
Quote:
root@unix [~]# set |grep HIST
HISTFILE=/root/.bash_history
HISTFILESIZE=1000
HISTSIZE=1000
HISTTIMEFORMAT='%h.%d %H:%M'
root@unix [~]#
I can't find anything regarding history on .bash_profile or .bashrc
Where this is set? How i enable loging command execution on CentOS?
Activity On Ports 1028 And 135
Jan 14, 2008my Windows 2003 server is showing a very steady amount of action on Port 1028 and Port 135.
The Process is listed as "Unknown" with a PID of 0
The Local IP is 127.0.0.1
The Remote IP is 127.0.0.1
The Remote Port is either 1028 or 135
The State is "TIME_WAIT"
The Protocol is TCP
The path to the executable is blank. At any given time there are at least 20 active processes of this. The virus scan says all is well.
History About NAVISITE ALABANZA Migration
May 29, 2009take a moment and go to : alabanzamigrationsettlement dot com
you can see a class action was made by Alabanza Customers
and finally has worked for all Alabanza cutomers
let me know if you get payments from RUST CONSULTING
My History With KnownHost: One Month Review
Aug 25, 2008The Past Month (23 of July) i purchased two Mini VPS to check KnownHost Performance.
Great.
Yesterday I Begin to think in move some VPS with them, and i enter to check my VPS, and Are DOWN. No Notice emails, no nothing.
I Write to Support, and some minutes later they pass me to billing. Then i realize Immediatly the problem. One Partner of me, is a verified Paypal SPANIARD with vacation in Mexico, she Pay the Two Invoices, and Maybe Paypal reverse the payment.
I understand. Is ok ...
Jarhosts Limited (Fraudulant Activity)
Jan 23, 2009Last week, we received a letter [url] from Companies House (the UK entity which governs companies).
It was addressed to Exoware, with all the correct contact details, reminding me to submit statutory documents by a certain date or face a fine and/or prosecution.
It was sent to us, because apparently, Exoware is a director of Jarhosts limited. This is not true. We have never even heard of Jarhosts limited up to this point, but it appears they had ceased trading by the time we received the letter.
A few emails were exchanged between us and Companies House, which didn't really get us anywhere as they couldn't seem to understand our position, so I phoned them up myself. I got through to someone and explained our position and she informed me about the company and said they registered Exoware as a director of Jarhosts limited on 05/12/08 and they themselves promptly resigned from the company afterwards, so Exoware was the only remaining director.
After I declared that Exoware had no affiliation whatsoever with Jarhosts limited, she promptly forwarded the case to a department for dealing with fraudulent documents and said the company will dissolve soon and that we may hear from Companies House fraud department in the future.
So, my concerns are now at ease, but my curiosity still remains.
Does anybody know Jarhosts; how long they were around for, who they were owned by, or any relevant information about them? Or does anybody know of any reason that people would sign up a random business in the same industry as a director before bailing out of their own company? It all seems very obscure.
Highly Suspicious Activity - Log Files
Dec 17, 2007what to look out for in the log files, but a couple of things jumped out at me over the weekend:
I had 5 of these, I followed the link (I suppose is the referrer) but it takes you to a polish-hosted russian webpage that tries to infect your browser. So DONT VISIT THE WEBSITE unless you're virus checker is fully up to date!
Code:
shop.######.com: [15/Dec/2007:02:52:43 +0000] 87.118.120.23 - - "GET / HTTP/1.0" 200 21466 [url] (compatible; MSIE 6.0; Windows NT 5.2; Win64; AMD64)"
As this is only a GET, I'm not sure what the purpose of this really was.
Also I seem to be getting loads of these recently:
Code:
shop.######.com: [17/Dec/2007:08:21:41 +0000] 82.19.60.98 - - "GET /_vti_bin/index.php?main_page=page_not_found HTTP/1.1" 301 5 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1)"
Which I read is an automated hacker-bot checking for an unpatched MS server.
So my question is this;
What's the most effective thing we (as webmasters/hosts) can do to combat and report this sort of thing so we fight back against what's likely to be related to organised crime?
Rogue Network Activity From Dedicated Box
Aug 6, 2007I have a dedicated box with Fasthosts and they tell me they've detected that the server is talking out to other networks via IRC although there's no activity on port 53.
Can anyone point me in the right direction of steps to take to find out what this is and eliminate it?
Recent changes to server include...
Started SpamAssassin (with network checks on - could these be the cause?)
Installed Mongrel as a proxy server for RoR apps and configured Apache on port 80 to make use of two Mongrel processes.
Some other data about server as requested on sticky thread on this board:
Linux OS: Fedora Core 6
Kernel: 2.6.18-1.2798.fc6
Control Panel: Matrix LSA
Processes (ps -auxf):
Quote:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 2032 556 ? Ss Jul31 0:01 init [3]
root 2 0.0 0.0 0 0 ? S Jul31 0:00 [migration/0]
root 3 0.0 0.0 0 0 ? SN Jul31 0:00 [ksoftirqd/0]
root 4 0.0 0.0 0 0 ? S Jul31 0:00 [watchdog/0]
root 5 0.0 0.0 0 0 ? S Jul31 0:00 [migration/1]
root 6 0.0 0.0 0 0 ? SN Jul31 0:00 [ksoftirqd/1]
root 7 0.0 0.0 0 0 ? S Jul31 0:00 [watchdog/1]
root 8 0.0 0.0 0 0 ? S< Jul31 0:00 [events/0]
root 9 0.0 0.0 0 0 ? S< Jul31 0:00 [events/1]
root 10 0.0 0.0 0 0 ? S< Jul31 0:00 [khelper]
root 11 0.0 0.0 0 0 ? S< Jul31 0:00 [kthread]
root 15 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kblockd/0]
root 16 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kblockd/1]
root 17 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kacpid]
root 123 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [cqueue/0]
root 124 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [cqueue/1]
root 127 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [khubd]
root 129 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kseriod]
root 194 0.0 0.0 0 0 ? S Jul31 0:00 \_ [pdflush]
root 196 0.0 0.0 0 0 ? S< Jul31 0:14 \_ [kswapd0]
root 197 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [aio/0]
root 198 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [aio/1]
root 363 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kpsmoused]
root 393 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [ata/0]
root 394 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [ata/1]
root 395 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [ata_aux]
root 399 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [scsi_eh_0]
root 400 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [scsi_eh_1]
root 401 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kjournald]
root 421 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kauditd]
root 1305 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [hda_codec]
root 1461 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kmpathd/0]
root 1462 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kmpathd/1]
root 1469 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kmirrord]
root 1491 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kjournald]
root 1493 0.0 0.0 0 0 ? S< Jul31 0:01 \_ [kjournald]
root 1495 0.0 0.0 0 0 ? S< Jul31 0:07 \_ [kjournald]
root 2105 0.0 0.0 0 0 ? S< Jul31 0:02 \_ [rpciod/0]
root 2106 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [rpciod/1]
root 2143 0.0 0.0 0 0 ? S Aug04 0:00 \_ [pdflush]
root 447 0.0 0.0 2212 332 ? S<s Jul31 0:00 /sbin/udevd -d
root 1629 0.0 0.0 1624 364 ? Ss Jul31 0:00 cpuspeed -d -n
root 1630 0.0 0.0 1624 348 ? S Jul31 0:00 \_ cpuspeed -d -n
root 1931 0.0 0.0 1692 580 ? Ss Jul31 0:06 syslogd -m 0
root 1934 0.0 0.0 1640 316 ? Ss Jul31 0:00 klogd -x
root 1943 0.0 0.0 1632 280 ? Ss Jul31 0:00 irqbalance
rpc 1964 0.0 0.0 1776 416 ? Ss Jul31 0:00 portmap
root 1982 0.0 0.0 1884 604 ? Ss Jul31 0:00 rpc.statd
root 1989 0.0 0.0 1628 232 ? S Jul31 0:00 /usr/sbin/courierlogger -pid=/var/spool/authdaemon/pid -star
root 1990 0.0 0.0 2120 544 ? S Jul31 0:00 \_ /usr/libexec/courier-authlib/authdaemond
root 2008 0.0 0.1 2964 1452 ? S Jul31 0:01 \_ /usr/libexec/courier-authlib/authdaemond
root 2009 0.0 0.0 2172 752 ? S Jul31 0:01 \_ /usr/libexec/courier-authlib/authdaemond
root 2010 0.0 0.1 2584 1172 ? S Jul31 0:01 \_ /usr/libexec/courier-authlib/authdaemond
root 2011 0.0 0.0 2172 752 ? S Jul31 0:01 \_ /usr/libexec/courier-authlib/authdaemond
root 2012 0.0 0.1 2964 1456 ? S Jul31 0:01 \_ /usr/libexec/courier-authlib/authdaemond
root 2022 0.0 0.0 4932 308 ? Ss Jul31 0:00 rpc.idmapd
dbus 2034 0.0 0.0 3140 308 ? Ss Jul31 0:00 dbus-daemon --system
root 2042 0.0 0.0 2344 416 ? Ss Jul31 0:00 hcid: processing events
root 2048 0.0 0.0 1712 368 ? Ss Jul31 0:00 /usr/sbin/sdpd
root 2072 0.0 0.0 0 0 ? S< Jul31 0:00 [krfcommd]
root 2107 0.0 0.0 0 0 ? S Jul31 0:00 [lockd]
root 2124 0.0 0.0 12692 552 ? Ssl Jul31 0:00 pcscd
root 2141 0.0 0.0 1876 348 ? Ss Jul31 0:00 /usr/bin/hidd --server
root 2154 0.0 0.0 9044 708 ? Ssl Jul31 0:00 automount
root 2170 0.0 0.0 1640 392 ? Ss Jul31 0:00 /usr/sbin/acpid
root 2187 0.0 0.0 5172 716 ? Ss Jul31 0:02 /usr/sbin/sshd
root 14427 0.0 0.2 8172 2468 ? Ss 14:09 0:00 \_ sshd: root@pts/0
root 14432 0.0 0.1 4620 1472 pts/0 Ss 14:09 0:00 \_ -bash
root 17290 0.0 0.0 4192 936 pts/0 R+ 16:35 0:00 \_ ps -auxf
root 2258 0.0 0.0 4488 544 ? S Jul31 0:00 /bin/sh /usr/bin/mysqld_safe --defaults-file=/etc/my.cnf --p
mysql 2294 0.0 0.6 139508 6432 ? Sl Jul31 1:26 \_ /usr/libexec/mysqld --defaults-file=/etc/my.cnf --basedi
root 2401 0.0 0.1 6240 1344 ? Ss Jul31 0:06 /usr/libexec/postfix/master
postfix 20416 0.0 0.1 6484 1612 ? S Aug03 0:01 \_ qmgr -l -t fifo -u
postfix 16541 0.0 0.1 6300 1664 ? S 15:31 0:00 \_ pickup -l -t fifo -u
postfix 17111 0.0 0.1 6292 1644 ? S 16:21 0:00 \_ anvil -l -t unix -u
postfix 17248 0.0 0.1 6308 1980 ? S 16:33 0:00 \_ trivial-rewrite -n rewrite -t unix -u
postfix 17273 0.0 0.1 6468 1876 ? S 16:34 0:00 \_ smtp -t unix -u
postfix 17274 0.0 0.1 6468 1880 ? S 16:34 0:00 \_ smtp -t unix -u
postfix 17275 0.0 0.1 6468 1876 ? S 16:34 0:00 \_ smtp -t unix -u
postfix 17276 0.0 0.1 6464 1832 ? S 16:34 0:00 \_ smtp -t unix -u
postfix 17277 0.0 0.1 6468 1880 ? S 16:34 0:00 \_ smtp -t unix -u
postfix 17278 0.0 0.1 6468 1880 ? S 16:34 0:00 \_ smtp -t unix -u
postfix 17281 0.0 0.1 6340 1660 ? S 16:34 0:00 \_ bounce -z -n defer -t unix -u
postfix 17283 0.0 0.1 6340 1640 ? S 16:34 0:00 \_ bounce -z -n defer -t unix -u
root 2411 0.0 0.0 1864 292 ? Ss Jul31 0:00 gpm -m /dev/input/mice -t exps2
root 2434 0.0 0.1 5804 1648 ? Ss Jul31 0:00 /usr/sbin/httpd-matrixsa
apache 15100 0.0 0.1 5948 1856 ? S Aug05 0:00 \_ /usr/sbin/httpd-matrixsa
apache 15101 0.0 0.1 5948 1704 ? S Aug05 0:00 \_ /usr/sbin/httpd-matrixsa
apache 14593 0.0 0.1 5948 1852 ? S 14:22 0:00 \_ /usr/sbin/httpd-matrixsa
root 2442 0.0 0.0 5216 596 ? Ss Jul31 0:00 crond
xfs 2465 0.0 0.0 3132 548 ? Ss Jul31 0:00 xfs -droppriv -daemon
root 2480 0.0 0.0 2204 348 ? Ss Jul31 0:00 /usr/sbin/atd
root 2501 0.0 0.1 24212 1372 ? S Jul31 0:00 /usr/bin/python /usr/sbin/yum-updatesd
avahi 2510 0.0 0.0 2864 612 ? Ss Jul31 0:00 avahi-daemon: running [server88-208-201-113.local]
avahi 2511 0.0 0.0 2864 124 ? Ss Jul31 0:00 \_ avahi-daemon: chroot helper process
68 2520 0.0 0.1 5708 1100 ? Ss Jul31 0:00 hald
root 2522 0.0 0.0 3336 520 ? S Jul31 0:00 \_ hald-runner
68 2553 0.0 0.0 2292 568 ? S Jul31 0:00 \_ hald-addon-acpi: listening on acpid socket /var/run/
root 2554 0.0 0.0 3392 520 ? S Jul31 0:00 \_ /usr/libexec/hald-addon-cpufreq
68 2560 0.0 0.0 2288 564 ? S Jul31 0:00 \_ hald-addon-keyboard: listening on /dev/input/event2
68 2563 0.0 0.0 2288 564 ? S Jul31 0:00 \_ hald-addon-keyboard: listening on /dev/input/event0
ntp 2607 0.0 0.0 4128 944 ? Ss Jul31 0:00 ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
root 2667 0.0 0.0 1628 380 tty1 Ss+ Jul31 0:00 /sbin/mingetty tty1
root 2668 0.0 0.0 1628 360 tty2 Ss+ Jul31 0:00 /sbin/mingetty tty2
root 2671 0.0 0.0 1628 360 tty3 Ss+ Jul31 0:00 /sbin/mingetty tty3
root 2672 0.0 0.0 1628 360 tty4 Ss+ Jul31 0:00 /sbin/mingetty tty4
root 2673 0.0 0.0 1628 360 tty5 Ss+ Jul31 0:00 /sbin/mingetty tty5
root 2683 0.0 0.0 1628 360 tty6 Ss+ Jul31 0:00 /sbin/mingetty tty6
root 4656 0.0 0.0 1628 296 ? S Jul31 0:00 /usr/sbin/courierlogger -pid=/var/run/imapd.pid -start -name
root 4657 0.0 0.0 1732 504 ? S Jul31 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -ma
1003 8661 0.0 0.1 2344 1316 ? S 10:00 0:11 \_ /usr/lib/courier-imap/bin/imapd /home/default/polloc
1001 9528 0.2 0.2 3860 2772 ? S 10:24 1:05 \_ /usr/lib/courier-imap/bin/imapd /home/default/aaronp
1003 15914 0.0 0.1 2200 1072 ? S 14:43 0:00 \_ /usr/lib/courier-imap/bin/imapd /home/default/polloc
1001 17199 0.0 0.0 2124 1020 ? S 16:27 0:00 \_ /usr/lib/courier-imap/bin/imapd /home/default/aaronp
root 4663 0.0 0.0 1632 168 ? S Jul31 0:00 /usr/sbin/courierlogger -pid=/var/run/imapd-ssl.pid -start -
root 4664 0.0 0.0 1732 428 ? S Jul31 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -ma
root 4669 0.0 0.0 1632 300 ? S Jul31 0:00 /usr/sbin/courierlogger -pid=/var/run/pop3d.pid -start -name
root 4670 0.0 0.0 1732 500 ? S Jul31 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -ma
root 4675 0.0 0.0 1628 168 ? S Jul31 0:00 /usr/sbin/courierlogger -pid=/var/run/pop3d-ssl.pid -start -
root 4676 0.0 0.0 1736 428 ? S Jul31 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -ma
root 14860 0.0 1.5 33316 15544 ? Ss Aug03 0:01 /usr/sbin/httpd
apache 30327 0.0 2.1 43480 21688 ? S 01:55 0:16 \_ /usr/sbin/httpd
apache 30328 0.0 2.0 43220 21180 ? S 01:55 0:15 \_ /usr/sbin/httpd
apache 30329 0.0 2.1 43616 21868 ? S 01:55 0:13 \_ /usr/sbin/httpd
apache 30330 0.0 2.1 44132 22308 ? S 01:55 0:16 \_ /usr/sbin/httpd
apache 30331 0.0 2.2 44660 23384 ? S 01:55 0:15 \_ /usr/sbin/httpd
apache 30332 0.0 2.2 44604 22820 ? S 01:55 0:14 \_ /usr/sbin/httpd
apache 30333 0.0 2.0 43576 21532 ? S 01:55 0:17 \_ /usr/sbin/httpd
apache 30334 0.0 2.1 43908 22064 ? S 01:55 0:17 \_ /usr/sbin/httpd
apache 11425 0.0 1.9 42328 20276 ? S 10:53 0:12 \_ /usr/sbin/httpd
apache 16125 0.0 1.6 40572 17052 ? S 15:04 0:01 \_ /usr/sbin/httpd
apache 16126 0.0 1.6 40564 16696 ? S 15:04 0:01 \_ /usr/sbin/httpd
apache 16581 0.0 1.5 40508 16412 ? S 15:34 0:00 \_ /usr/sbin/httpd
apache 16582 0.0 1.6 40612 16436 ? S 15:34 0:00 \_ /usr/sbin/httpd
apache 16637 0.0 1.6 40496 16660 ? S 15:38 0:00 \_ /usr/sbin/httpd
mongrel 15242 0.0 2.8 45536 29104 ? Sl Aug03 0:03 /usr/bin/ruby /usr/bin/mongrel_rails start -d -e production
mongrel 15245 0.0 0.0 42184 828 ? Sl Aug03 0:02 /usr/bin/ruby /usr/bin/mongrel_rails start -d -e production
apache 27873 0.0 0.0 1608 244 ? Ss Aug04 0:00 /usr/local/apache/bin/httpd -DSSL
apache 28536 0.0 0.2 4556 2408 ? S Aug04 0:01 /usr/local/apache/bin/httpd -DSSL
apache 32052 0.0 0.2 4552 2400 ? S Aug04 0:01 /usr/local/apache/bin/httpd -DSSL
apache 32094 0.0 0.2 4552 2400 ? S Aug04 0:01 /usr/local/apache/bin/httpd -DSSL
root 15106 0.0 0.2 9836 2056 ? Ss Aug05 0:00 cupsd
root 15135 0.0 1.2 90504 12360 ? Sl Aug05 0:11 python2 MatrixSALaunch.py ThreadedAppServer
apache 19934 0.0 0.3 6096 3864 ? S Aug05 0:00 /usr/local/apache/bin/httpd -DSSL
1001 8664 0.0 0.1 2524 1044 ? S 10:00 0:00 /usr/libexec/gam_server
1003 8666 0.0 0.1 2528 1040 ? S 10:00 0:00 /usr/libexec/gam_server
root 17068 0.0 2.6 31508 27016 ? Ss 16:16 0:00 /usr/bin/spamd -d -c -m5 -H -r /var/run/spamd.pid
root 17070 0.1 2.8 33752 29236 ? S 16:17 0:01 \_ spamd child
root 17071 0.0 2.7 32432 27772 ? S 16:17 0:00 \_ spamd child
vmstat 5 5:
Quote:
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------
r b swpd free buff cache si so bi bo in cs us sy id wa st
0 1 86800 26008 285380 234780 0 0 3 10 21 1 0 0 99 0 0
0 0 86800 26716 285396 234792 0 0 0 98 289 538 4 1 94 0 0
0 0 86800 26764 285404 234792 0 0 0 62 254 333 0 0 100 0 0
0 0 86800 26772 285404 234792 0 0 0 0 255 346 0 0 100 0 0
0 0 86800 26772 285416 234792 0 0 0 16 253 408 0 0 100 0 0
FluidVPS/Fluidhosting 6 Month Review/history
Aug 2, 2008Before I start on my review, I would like to say that I am not affiliated with FluidVPS in any way and am solely doing this because I would like to share my experiences with everyone.
I was one of the lucky few to be able to get a 'Free VPS' from FHDave (Fluidhosting) as part of their new promotion of upgrading hardware nodes.
My VPS has the following specs:
512 MB memory guaranteed
25 GB disk space
500 GB transfer bandwidth
When I just got my VPS I installed various applications such as Shoutcast and Tomcat simply because I could and I love it how it is automated.
My first ticket was a problem getting Shoutcast to work, and so I contacted and placed a ticket. Even though my free VPS was unmanaged, I still got them to help me which resulted in a simple restart of the server.
All was good for a few weeks until my forum was hacked one day (my guess was a weak password and some skiddie got access) which caused damage to my forum. After getting pretty worried I contacted Fluidhosting to find out if my VPS could get hardened I was prompted to pay since my VPS was free, it was 'unmanaged'. They did link me to their knowledgebase for tutorials and I applied them. Thinking it was enough I gave a sigh of relief and carried on with my life.
2 weeks later I was prompted with my VPS becoming compromised (someone hacked the VPS and used it to host an eBay phisher). Even though I had been told my VPS was 'unmanaged' they helped me with getting my VPS reprovisioned. I changed all my passwords to numbers and letters and that was the end of that.
I did have some problems with their Parallel Power Panel and HSPC although I cannot link it to the hack attempt. What happened was I was unable to restart the VPS and it would fail making my server go down. I submitted a ticket as well as contacted their live chat service and they tried fixing it. It didn't work and had to get help from the developers of the panel. However after a few hours my VPS was back! (I was asleep when it happened )
There were times during my hosting where my bandwidth had nearly been used up and my webspace being completely filled. I have found that some hosts oversell their resources and when you haven't used a quarter of the limit they suspend your account. This was not the case with Fluidhosting. My VPS was often always full and yet there was no problem. I have even used it to host torrentflux for my own usage and that was fine too.
There were times such as the VPS being compromised where Fluidhosting and their staff could have just suspended my account for good, and left me because of my website being too much trouble. They stuck with me to the end and helped me all the way. Their support is quick and helpful (gets the job done, real initiative there) and their live chat isn't just a salesperson.
My past 6 months was one heck of a journey, and it would have not been possible if I had not gotten a top notch service provider from Dave and the team. Thank you for an awesome opportunity to try out VPSes for a change. Once you use VPSes there's no going back!
I will be paying another 6 months with you guys (if all goes well at my end).
Sorry if this isn't quite 'a review', more like past history of my webhosting
So in short:
Service: 9/10
Resources: 10/10
Support: 9/10
Uptime: 10/10
How Save All History And All Command Running In Putty
Jul 18, 2008i use for login to ssh by putty
and i run very command and result
how may i saved all this command and result in putty?
Plesk 11.x / Linux :: Report Traffic History Empty
Aug 16, 2013Our Server doesn't show the Traffic History under "Tools & Settings -> Summary Report -> View Traffic History", but for every Domain it runs.
We Migrate this Server from a Dedicated to an OpenVZ Server - on another Server with OpenVZ its running without Problems, but this one we don't migrate.
Apachetop / Munin / Nagios - Best Way To View Apache + Other Service Activity
Nov 12, 2008On Cpanel/WHM. I have just moved from a VPS to a dedicated server. I reinstalled munin, so get some stats via that. I used to have apachetop loaded on my VPS for when I wanted a 'near realtime' streaming view of apache access.
I'm wondering what the best solution is to get a good view of apache, like what apachetop did, plus also it would be nice to have a real-time monitor of MySQL activity, HDD activity (such as I/O queues, etc. Something along the lines of the perfmon on Windows servers.
What is my best option?
Also, with Nagios, when I look at the website, it seems there are two options. Load it on a single server and then load the stats via [url]or have the Nagios 'stat collector' on one machine, and have it gathering stats from multiple machines.
If you only install it on a single dedicated server, do you really have to be on the console and connect to the Nagios stats via localhost, rather than connecting remotely?
Ideally, I would like a quick, easy to setup solution, but if it takes some configuring, I can deal with it, as long as there is some documentation. My main goal is to get the real time type monitoring, you get with window's perfmon.
Redirect Domain/user To User.domain ONLY IF Folder 'user' Doesn't Exist
May 7, 2007I thought I knew enough about my .htaccess stuff to do this, but I can't seem to work it out. What I want to do is if a user visits domain.com/folder, we check to see if the folder exists. If so, show as normal (IE domain.com/support)
If a user visits domain.com/dynamicusername (dynamicusername is not a physical folder), redirect to dynamicusername.domain.com
Remove SSH " History "
May 22, 2007How would I go about removing the History when using SSH?
View 9 Replies View RelatedPlesk Automation :: Login As User From Admin / Actual Login As User Are Different
Jan 3, 2014when I find the subscription from the admin side of PPA, if I select "Login as user" I've noticed that it is different from actually logging in as the user - for example - "add domain alias" is missing when I login as a customer - but not as an admin... I need my customers to add their own aliases and manage them - how do I add that feature to the client login side?
View 9 Replies View RelatedUser Nobody Using Too Much Cpu
Aug 13, 2008use "nobody" is using 2much cpu on my server ... can someone explain me how is this possible ?
[url]
I already have checked
"Prevent the user "nobody" from sending out mail to remote addresses (PHP and CGI scripts generally run as nobody if you are not using PHPSuexec and Suexec respectively.)"
In tweak settings.
No User At TOP - All Are Nobody
Aug 6, 2008when I run top command I should see who user are running and I see only my root and no body
2840 mysql 15 0 181m 78m 4568 S 22 1.0 1102:41 mysqld
4078 nobody 16 0 37128 17m 3300 S 5 0.2 0:00.99 httpd
4032 nobody 15 0 37600 18m 3364 S 5 0.2 0:00.35 httpd
3541 nobody 17 0 38200 18m 3300 S 4 0.2 0:00.73 httpd
3598 nobody 16 0 41744 21m 3288 S 4 0.3 0:01.26 httpd
3738 nobody 15 0 39820 19m 3276 S 3 0.2 0:00.63 httpd
4052 nobody 15 0 38436 18m 3376 S 2 0.2 0:01.63 httpd
3428 nobody 15 0 37040 17m 3388 S 2 0.2 0:00.60 httpd
3806 nobody 17 0 38404 18m 3316 S 2 0.2 0:00.70 httpd
4036 nobody 15 0 38408 18m 3300 S 1 0.2 0:00.52 httpd
4072 nobody 15 0 44216 24m 3424 S 1 0.3 0:01.03 httpd
3402 nobody 15 0 38296 18m 3320 S 0 0.2 0:01.05 httpd
3437 nobody 15 0 41632 22m 3616 S 0 0.3 0:01.25 httpd
3505 nobody 15 0 37412 17m 3428 S 0 0.2 0:00.89 httpd
3523 nobody 15 0 41432 21m 3252 S 0 0.3 0:00.30 httpd
3542 nobody 15 0 42720 22m 3388 S 0 0.3 0:00.88 httpd
3581 nobody 15 0 37464 17m 3272 S 0 0.2 0:00.40 httpd
3602 nobody 15 0 38472 18m 3420 S 0 0.2 0:00.31 httpd
3643 nobody 15 0 37788 18m 3308 S 0 0.2 0:00.50 httpd
3644 nobody 15 0 35120 15m 3000 S 0 0.2 0:00.03 httpd
3645 nobody 15 0 41816 21m 3276 S 0 0.3 0:00.52 httpd
3647 nobody 15 0 42908 23m 3408 S 0 0.3 0:01.20 httpd
3723 nobody 15 0 36260 16m 3408 S 0 0.2 0:00.85 httpd
3805 nobody 15 0 37512 17m 3272 S 0 0.2 0:00.44 httpd
4046 nobody 15 0 39596 19m 3284 S 0 0.2 0:01.41 httpd
4567 root 15 0 2452 1224 796 R 0 0.0 0:01.04 top
7826 root 15 0 0 0 0 S 0 0.0 0:06.21 pdflush
10001 root 15 0 12920 8528 1292 S 0 0.1 0:18.65 lfd
1 root 16 0 2060 636 544 S 0 0.0 0:12.09 init
2 root RT 0 0 0 0 S 0 0.0 0:01.15 migration/0
3 root 34 19 0 0 0 S 0 0.0 0:00.14 ksoftirqd/0
4 root RT 0 0 0 0 S 0 0.0 0:00.00 watchdog/0
5 root RT 0 0 0 0 S 0 0.0 0:00.63 migration/1
6 root 34 19 0 0 0 S 0 0.0 0:00.09 ksoftirqd/1
7 root RT 0 0 0 0 S 0 0.0 0:00.00 watchdog/1
8 root RT 0 0 0 0 S 0 0.0 0:01.29 migration/2
9 root 34 19 0 0 0 S 0 0.0 0:00.18 ksoftirqd/2
----------------------
and I can't know who are runing in my server