Date: Fri, 12 Oct 2007 02:43:59 -0500 From: CyberLeo Kitsana <cyberleo@cyberleo.net> To: Zbigniew Szalbot <zszalbot@gmail.com> Cc: Freebsd questions <freebsd-questions@freebsd.org> Subject: Re: uid 80: exited on signal 6 Message-ID: <470F25BF.1000805@cyberleo.net> In-Reply-To: <9e83978cc36db6e49da9d81ac8e300ac@szalbot.homedns.org> References: <9e83978cc36db6e49da9d81ac8e300ac@szalbot.homedns.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Zbigniew Szalbot wrote: > szalbot.homedns.org kernel log messages: +++ /tmp/security.BfIqepKO Fri Oct > 12 03:08:35 2007 > +pid 82543 (httpd), uid 80: exited on signal 6 > +pid 82542 (httpd), uid 80: exited on signal 6 > +pid 82541 (httpd), uid 80: exited on signal 6 > +pid 82537 (httpd), uid 80: exited on signal 6 > +pid 82533 (httpd), uid 80: exited on signal 6 > +pid 82536 (httpd), uid 80: exited on signal 6 > +pid 82535 (httpd), uid 80: exited on signal 6 > +pid 82534 (httpd), uid 80: exited on signal 6 > +pid 3653 (httpd), uid 80: exited on signal 6 This means that the httpd child processes are crashing, most likely in response to a request. Because apache creates child processes dynamically to handle load (at least, with the default MPM) these crashed processes are automatically replaced, and the server continues happily servicing requests. It might be a good idea to go through your access and error logs and see if there are any suspicious-looking or unusually long requests that might be trying to exploit a buffer overflow vulnerability in apache or a module thereof. If you are using mod_php, though, it's more likely that it's a bug in PHP or a PHP extension that's being flushed out by some rarely used script on your server. -- Fuzzy love, -CyberLeo Technical Administrator CyberLeo.Net Webhosting http://www.CyberLeo.Net <CyberLeo@CyberLeo.Net> Furry Peace! - http://wwww.fur.com/peace/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?470F25BF.1000805>