Re: [cobalt-users] HELP HELP HELP RAQ4r CPU slowly creeps up till server is un-usable

[Jeff Lasman <jblists@xxxxxxxxxxxxx>]

Matt wrote:

> Thank You Everyone For All Of Your Help!

Matt, there are days when I just can't get any time to log in, so the
first time I read of your plight was this afternoon.

As I read all the posts I kept thinking it was a raid issue.  Until I
read your post of Friday 9:48 am; the one where you wrote:

  I just did a "netstat -a" I and I did see an abnormal amount of RAW
  TCP connections;; This seems odd, but I do not know what it is..

Then I figured it must be a hack.

It looks like that's what it was.

<frown>

I don't recall reading if you ever ran chkrootkit?  I strongly urge you
and everyone else, gets it from "http://www.chkrootkit.org/";, installs
it (# make sense) and then sets up a cron job to mail you the output at
least once a day.

Jeff
-- 
Jeff Lasman, nobaloney.net, P. O. Box 52672, Riverside, CA  92517 US
Internet & Unix/Linux/Sun/Cobalt Consulting +1 909 778-9980
Our jblists address used on lists is for list email only
To contact us offlist: "http://www.nobaloney.net/contactus.html";