Question about multiple httpd processes
I have reason to suspect something is "up" on my server. I've checked the most used processes on the server and they are:
root 13.83 6.58 1.9
Top Process %CPU 99.9 /usr/sbin/lsof -F n
Top Process %CPU 47.0 /usr/bin/perl /usr/local/cpanel/bin/mkvhostspasswd
Top Process %CPU 23.1 /usr/sbin/exim -Mc 1Cu30i-0004Yt-Er
I've run rkhunter and chkrootkit and nothing comes up. When I execute "top" I get all these httpd processes - I remember that top only shows one httpd process and groups them all under this one listed process. Why now is top showing multiple httpd processes. Plus the number shown does not correlate to the number shown by "ps -aux" command. Has a user on my server tried to setup a virtual private server or something???? Does RHE "top" process normally show multiple "httpd" processes?
Here is some "top" output:
26446 nobody 15 0 22104 21M 5452 S 0.6 1.0 0:09 3 httpd
19219 nobody 16 0 18336 17M 5148 S 0.5 0.8 0:00 3 httpd
17738 nobody 15 0 20820 20M 5416 S 0.4 1.0 0:00 3 httpd
18872 nobody 15 0 18672 18M 5188 S 0.4 0.9 0:00 2 httpd
26469 nobody 15 0 21272 19M 5488 S 0.3 0.9 0:04 2 httpd
26430 nobody 15 0 22028 21M 5520 S 0.2 1.0 0:07 0 httpd
3262 named 15 0 14488 12M 2208 S 0.1 0.6 0:16 1 named
28011 nobody 15 0 21404 20M 5424 S 0.1 1.0 0:06 2 httpd
18286 root 16 0 1368 1368 896 R 0.1 0.0 0:01 1 top
18861 nobody 15 0 18580 18M 5208 S 0.1 0.9 0:00 2 httpd
1 root 15 0 504 504 448 S 0.0 0.0 0:05 1 init
Any ideas? Why would the process
/usr/bin/perl /usr/local/cpanel/bin/mkvhostspasswd
be being used so much? And I'm concerned about the process:
/usr/sbin/lsof -F n
being used also. I recently had a client from Panama signup - I was going to cancel his order but he contacted me and his details did check out - so????
