Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : whho is using sendmail???

[WWWhost]

hi,
just have a high server load and saw somone using sendmail :
-----
10294 mailnull 23 0 1876 1876 1536 R 0.1 0.1 0:00 0 /usr/sbin/sendmail -t -i
-----
how can i know with user does use that sendmail process?


thanks a lot

[Steven]

phps mail() functionw ill use sendmail.

[WWWhost]

ok but how to know withc account??
i currently have this situation:
----------
01:17:41 up 1 day, 10:45, 1 user, load average: 21.66, 18.30, 12.49
163 processes: 146 sleeping, 16 running, 1 zombie, 0 stopped
CPU states: 68.6% user 28.9% system 0.0% nice 0.0% iowait 2.3% idle
Mem: 998600k av, 977240k used, 21360k free, 0k shrd, 124552k buff
661232k actv, 65172k in_d, 18660k in_c
Swap: 522104k av, 148056k used, 374048k free 469296k cached

PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
1463 mailnull 16 0 1780 1780 1468 S 99.9 0.1 0:01 0 /usr/sbin/exim -bd -q120m
3778 mysql 15 0 83892 54M 1504 S 1.5 5.5 8:42 0 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --us
2419 root 23 0 3412 3412 2528 S 1.5 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP5-0000cK-Mo
2539 root 23 0 3408 3408 2528 S 1.5 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP8-0000dx-9y
2541 root 24 0 3412 3412 2528 S 1.5 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP8-0000e9-Hd
2561 root 23 0 3444 3444 2560 S 1.3 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP9-0000ew-8j
2568 root 23 0 3440 3440 2560 S 1.3 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP9-0000fL-Re
2482 someuser 19 0 3388 2640 1152 S 1.1 0.2 0:00 0 cppop - serving 201.128.167.65 - TRANSACTION - mario@mario
2548 root 23 0 3444 3444 2560 S 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP9-0000ey-Aq
2564 root 23 0 3444 3444 2560 S 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP9-0000eu-5r
2574 root 23 0 3448 3448 2560 S 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP9-0000f7-GQ
2591 root 23 0 3440 3440 2560 S 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vPA-0000fP-60
2458 root 22 0 3392 3392 2484 S 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP6-0000bR-Ga
2537 root 23 0 3408 3408 2528 S 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP8-0000du-8b
2566 root 23 0 3444 3444 2560 S 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP9-0000f0-E8
2578 root 23 0 3388 3388 2484 S 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP9-0000dO-Sc
2593 root 23 0 3308 3308 2420 R 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vPA-0000fS-7c
2596 root 23 0 3428 3428 2544 R 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vPA-0000fN-0X
2600 root 23 0 3372 3372 2468 D 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP9-0000dR-VV
5040 root 15 0 26624 18M 1988 S 0.7 1.8 3:56 0 /usr/local/apache/bin/httpd -DSSL
5633 root 15 0 3252 1788 632 S 0.7 0.1 0:11 0 /usr/bin/perl /usr/local/cpanel/bin/eximstats
2429 root 23 0 3408 3408 2528 S 0.7 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP6-0000cr-Kq
2490 mailnull 21 0 3428 3428 2520 D 0.7 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP7-0000bp-Dt
5527 named 24 0 19504 17M 928 S 0.5 1.8 8:52 0 /usr/sbin/named -u named
2388 root 22 0 3380 3380 2484 S 0.5 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP4-0000aS-Q8
2586 root 23 0 3384 3384 2484 S 0.5 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vP9-0000dD-LM
2592 mailnull 22 0 1876 1876 1536 R 0.3 0.1 0:00 0 /usr/sbin/sendmail -t -i
2594 mailnull 22 0 1852 1852 1520 R 0.3 0.1 0:00 0 /usr/sbin/sendmail -t -i
1 root 22 0 112 84 56 S 0.1 0.0 0:09 0 init
1859 root 15 0 1136 1136 840 R 0.1 0.1 0:00 0 top
2576 mailnull 22 0 1872 1872 1536 R 0.1 0.1 0:00 0 /usr/sbin/sendmail -t -i
2597 mailnull 22 0 1860 1860 1524 D 0.1 0.1 0:00 0 /usr/sbin/sendmail -t -i
2 root 15 0 0 0 0 SW 0.0 0.0 0:00 0 keventd
3 root 15 0 0 0 0 SW 0.0 0.0 0:00 0 kapmd
4 root 34 19 0 0 0 SWN 0.0 0.0 0:02 0 ksoftirqd_CPU0
9 root 25 0 0 0 0 SW 0.0 0.0 0:00 0 bdflush

[WWWhost]

and this:
1463 mailnull 17 0 1664 1664 1352 S 99.9 0.1 0:00 0 /usr/sbin/exim -bd -q120m
3778 mysql 15 0 83884 55M 1496 S 1.9 5.6 8:46 0 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --us
11166 root 22 0 3416 3416 2536 S 1.5 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSi-0002sk-Hq
11191 root 23 0 3444 3444 2560 S 1.5 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSk-0002u7-6f
11193 root 23 0 3444 3444 2560 S 1.5 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSk-0002u3-0X
11148 root 23 0 3440 3440 2552 S 1.3 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSj-0002tg-Kw
11182 mailnull 21 0 3424 3424 2520 D 1.3 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSi-0002ro-O6
11183 root 22 0 3440 3440 2560 S 1.3 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSj-0002tt-Rx
11221 root 23 0 3440 3440 2560 S 1.3 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSk-0002uY-MT
11099 mailnull 20 0 3468 3468 2584 D 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSh-0002s0-Fh
11142 root 20 0 3364 3364 2460 S 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSi-0002pr-7d
11162 root 22 0 3416 3416 2536 S 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSi-0002sg-EL
11164 mailnull 21 0 3468 3468 2584 D 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSi-0002sz-RL
11174 mailnull 21 0 3416 3416 2504 D 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSi-0002r5-Lb
11202 root 21 0 3384 3384 2484 S 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSj-0002rf-SF
11205 root 21 0 3388 3388 2484 S 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSk-0002sc-LW
11207 root 23 0 3444 3444 2560 S 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSk-0002u5-3t
11215 root 23 0 3444 3444 2560 S 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSk-0002uO-Gz
11218 root 23 0 3440 3440 2560 S 1.1 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSl-0002un-53
5527 named 24 0 19504 18M 928 S 0.9 1.8 8:56 0 /usr/sbin/named -u named
11094 mailnull 20 0 3472 3472 2588 D 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSh-0002s2-IG
11108 root 22 0 3364 3364 2460 S 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSh-0002pR-LU
11143 mailnull 20 0 3412 3412 2504 D 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSi-0002qP-Ec
11195 root 23 0 3444 3444 2560 S 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSj-0002tp-QP
11204 root 21 0 3384 3384 2484 S 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSj-0002re-SG
11211 root 23 0 3444 3444 2560 S 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSk-0002uW-JZ
11223 someuser 20 0 3372 2600 1144 S 0.9 0.2 0:00 0 cppop - serving 200.67.206.249 - TRANSACTION - woolfalice6
11239 root 22 0 3388 3388 2484 S 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSk-0002r5-Nl
11243 root 23 0 3384 3384 2484 S 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSk-0002si-W7
11258 root 22 0 3372 3372 2468 D 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSl-0002tE-H6
11263 root 22 0 3364 3364 2468 D 0.9 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSl-0002sn-2I
11127 root 23 0 3360 3360 2460 S 0.7 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSi-0002re-9R
11246 root 22 0 3388 3388 2484 S 0.7 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSl-0002ss-5h
11268 root 23 0 3372 3372 2468 D 0.7 0.3 0:00 0 /usr/sbin/exim -Mc 1C1vSl-0002sy-8r
15 root 15 0 0 0 0 SW 0.3 0.0 2:02 0 kjournald
5633 root 16 0 3252 1788 632 S 0.3 0.1 0:13 0 /usr/bin/perl /usr/local/cpanel/bin/eximstats

[Steven]

looks like you got a spammer check ur mail queue in cpanel.

[WWWhost]

thelinuxguy -- do you meas in WHM?
ther is nothing strange... the only thing i can finde are a couple of messages loke this
--------
1C1vOc-0000Jb-Q2-H
nobody 99 99
<nobody@servername.server.com>
1093907826 0
-ident nobody
-received_protocol local
-body_linecount 1
-auth_id nobody
-auth_sender nobody@servername.server.com
-deliver_firsttime
-local
XX
1
x8t8x@hotmail.com

142P Received: from nobody by servername.server.com with local (Exim 4.34)
id 1C1vOc-0000Jb-Q2
for x8t8x@hotmail.com; Tue, 31 Aug 2004 01:17:07 +0200
022T To: x8t8x@hotmail.com
012 Subject: hi
049I Message-Id: <E1C1vOc-0000Jb-Q2@servername.server.com>
039F Wrom: NQEMSFDULHPQQWOYIYZUNNYCGPKYLEJGDGVCJ
042* X-rewrote-sender: nobody@servername.server.com
038 Date: Tue, 31 Aug 2004 01:17:06 +0200
---------


is there no other way to nkow who use all this cpu?

thanks a lot

[WWWhost]

checking exim_mainlog i se this:
----------
2004-08-31 01:20:05 1C1vRT-0001wR-K0 <= <> H=(mc4-s11.hotmail.com) [64.4.44.210] P=esmtp S=2686 id=p2SAWQ8AZ00000213@mc4-f18$
2004-08-31 01:20:05 1C1vRO-00021E-WB => somone@hotmail.com <nobody@train.an-dns.com> R=lookuphost T=remote_smtp H=mx1.hotm$
2004-08-31 01:20:05 1C1vRT-00021K-FG <= <> H=(mc4-s2.hotmail.com) [64.4.44.201] P=esmtp S=2684 id=bEFYamNfN000001a9@mc4-f16.$
2004-08-31 01:20:05 1C1vRP-00021U-NV => somone@hotmail.com <nobody@train.an-dns.com> R=lookuphost T=remote_smtp H=mx4.hotm$
2004-08-31 01:20:05 1C1vRU-00023M-O1 <= <> H=(mc4-s9.hotmail.com) [64.4.44.208] P=esmtp S=2684 id=lrjbudzxx00000248@mc4-f39.$
2004-08-31 01:20:05 1C1vRP-00021K-Gw => somone@hotmail.com <nobody@train.an-dns.com> R=lookuphost T=remote_smtp H=mx2.hotm$
2004-08-31 01:20:05 1C1vRU-00023k-Tv <= <> H=(mc4-s19.hotmail.com) [64.4.44.218] P=esmtp S=2682 id=c0Ne0PaLI000001d8@mc4-f9.$
2004-08-31 01:20:05 1C1vRP-00023O-OP => x8t8x@hotmail.com R=lookuphost T=remote_smtp H=mx1.hotmail.com [64.4.50.99]
2004-08-31 01:20:05 1C1vRT-00024W-GT <= <> H=(mc4-s1.hotmail.com) [64.4.44.200] P=esmtp S=2684 id=TtEvzoxJ6000001f1@mc4-f32.$
2004-08-31 01:20:05 1C1vRP-000238-CE => x8t8x@hotmail.com R=lookuphost T=remote_smtp H=mx1.hotmail.com [65.54.166.99]
2004-08-31 01:20:05 1C1vRT-00024K-85 <= <> H=(mc9-s6.hotmail.com) [65.54.165.15] P=esmtp S=2684 id=jGpnAKowZ00001f43@mc9-f24$
2004-08-31 01:20:05 1C1vRQ-000243-D8 => x8t8x@hotmail.com R=lookuphost T=remote_smtp H=mx2.hotmail.com [65.54.166.230]
2004-08-31 01:20:05 1C1vRT-00024L-8c <= <> H=(mc3-s15.hotmail.com) [65.54.163.214] P=esmtp S=2682 id=tEvzoxJ6s000002fe@mc3-f$
2004-08-31 01:20:05 1C1vRP-00023L-ME => x8t8x@hotmail.com R=lookuphost T=remote_smtp H=mx4.hotmail.com [65.54.190.230]
2004-08-31 01:20:05 1C1vRT-000273-IY <= nobody@train.an-dns.com U=nobody P=local S=315
2004-08-31 01:20:05 1C1vRQ-00023e-0F => x8t8x@hotmail.com R=lookuphost T=remote_smtp H=mx3.hotmail.com [65.54.167.5]
2004-08-31 01:20:05 1C1vRT-000278-KY <= nobody@train.an-dns.com U=nobody P=local S=315
2004-08-31 01:20:05 1C1vRQ-00021K-Il => somone@hotmail.com <nobody@train.an-dns.com> R=lookuphost T=remote_smtp H=mx4.hotm$
2004-08-31 01:20:05 1C1vRT-000275-Ko <= nobody@train.an-dns.com U=nobody P=local S=315
--------