Results 1 to 7 of 7
  1. #1
    Join Date
    Apr 2009

    Lots of apache graceful commands in top, under attack?

    There are I think at least 50 of user nobody running command /usr/local/apache/bin/httpd -k graceful

    Is this an attack?

    When I killed them one by one, now I see lots of these commands run by nobody:
    /usr/local/apache/bin/httpd -k start -DSSL

  2. #2
    'nobody' is an Apache user and all those are the connections to your websites. 50 isn't a large figure, however, if you would like to check the status of Apache connections, use either of the 2 options (both will show the same result):

    WHM >> Service Status >> Apache Status


    SSH to the server and execute:
    lynx http://localhost/whm-server-status

    To list and sort the IPs connecting to the Apache service, use the netstat command
    | Server Setup | Security | Optimization | Troubleshooting | Server Migration
    | Monthly and Task basis services.
    | MSN : madaboutlinux[at] | Skype : madaboutlinux

  3. #3
    Join Date
    Apr 2004
    New Hampshire
    Are you running cPanel\WHM? If so, what version? There is an issue with 11.25 that caused tons of graceful restarts, downgrading to 11.24 fixed it for us.
    Corey Arbogast | CEO
    █ 888-X10-9668, x703 - corey[@]

  4. #4
    You can check number of connections to apache server by using following command.

    netstat -anp | grep 80 | wc -l

    If this number is too large then, it could be ddos on your server. Apart from this you can try corey's advice.

  5. #5
    Yes, 50 of user nobody seems to be normal.
    What is the load on the server?
    Support Facility | 24/7 web hosting technical support services
    Technical support | Server management | Data migration

    Technical Articles

  6. #6
    Join Date
    Apr 2009
    Load is between 9 and 15

  7. #7
    Load between 9 to 15 doesn't seems to be fine. Its definitely sound like something nasty is happening on the server. Try to find what suspicious process are responsible for causing load. Use below command from more detail processes,

    # ps auxf or # top
    Shared Hosting | Reseller Hosting | VPS Hosting | Dedicated Servers

Similar Threads

  1. The Top 10 SSH commands you use the most
    By PYDOT in forum WebHostingTalk Subscribers Club
    Replies: 28
    Last Post: 12-30-2009, 10:07 AM
  2. Replies: 7
    Last Post: 08-15-2008, 02:53 AM
  3. Apache: Graceful restart requested, doing restart
    By guarriman in forum Dedicated Server
    Replies: 3
    Last Post: 10-11-2005, 03:31 PM
  4. executing commands as apache
    By Lem0nHead in forum Hosting Security and Technology
    Replies: 3
    Last Post: 07-24-2005, 07:40 PM
  5. Replies: 7
    Last Post: 07-27-2001, 11:04 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts