Time: Wed Jun 3 12:16:45 2009 -0400
PID: 21300
Account: mysql
Uptime: 40580 seconds
Executable:
/usr/sbin/mysqld\004a26035a\00\88\9c\04\08\88\0c\00 (deleted)
The file system shows this process is running an executable file that has been deleted. This typically happens when the original file has been replaced by a new file when the application is updated. To prevent this being reported again, restart the process that runs this excecutable file. See csf.conf and the PT_DELETED text for more information about the security implications of processes running deleted executable files.
Command Line (often faked in exploits):
/usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/***.pid --skip-external-locking --socket=/var/lib/mysql/mysql.sock
Network connections by the process (if any):
Files open by the process (if any):
Hi i am getting emails like this from CSF.
My csf.pignore has this:
exe:/usr/sbin/mysqld
exe:/usr/sbin/mysqld_safe
Running CSF 4.69.
How can i fix this (if anything to fix) but for some reason since last night i started getting these emails.
Thanks,
s-f-r-j
Linear Mode
