I am a newbie and my first server seems to have been hacked. I am not sure how to clean it. There are processes hogging the CPU that am not the owner of. All the 12 CPUs are almost all running at 100%. Kindly see htop screen shot  I have run a netstat and below is a summary of the output sudo netstat -anolp Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    Timer tcp        0      0 127.0.0.1:9001          0.0.0.0:*               LISTEN      4869/java           off (0.00/0/0) tcp        0      0 127.0.0.1:27017         0.0.0.0:*               LISTEN      15327/mongod        off (0.00/0/0) tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      4124/mysqld         off (0.00/0/0) tcp        0      0 127.0.0.1:9100          0.0.0.0:*               LISTEN      24415/node_exporter off (0.00/0/0) tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      16039/nginx -g daem off (0.00/0/0) tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      5824/config.ru      off (0.00/0/0) tcp        0      0 127.0.0.1:9168          0.0.0.0:*               LISTEN      24370/ruby          off (0.00/0/0) tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      13595/sshd          off (0.00/0/0) tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      2370/master         off (0.00/0/0) tcp        0      0 127.0.0.1:9121          0.0.0.0:*               LISTEN      24450/redis_exporte off (0.00/0/0) tcp        0      0 127.0.0.1:9090          0.0.0.0:*               LISTEN      24429/prometheus    off (0.00/0/0) tcp        0      0 127.0.0.1:9187          0.0.0.0:*               LISTEN      24421/postgres_expo off (0.00/0/0) tcp        0      1 my.ser.ver.ip:41037    172.247.116.47:2017     SYN_SENT    26521/mbb           on (57.32/6/0) tcp        0      0 my.ser.ver.ip:45599    124.112.1.160:29135     ESTABLISHED 32265/DDosClient    off (0.00/0/0) tcp        0      0 127.0.0.1:9001          127.0.0.1:54729         ESTABLISHED 4869/java           keepalive (2412.64/0/0) tcp        0      0 my.ser.ver.ip:49366    31.222.161.239:8080     ESTABLISHED 14106/hald-daemon   off (0.00/0/0) tcp        0      0 my.ser.ver.ip:57275    163.172.204.219:443     ESTABLISHED 20238/wDHnu         keepalive (45.40/0/0) tcp        0      0 127.0.0.1:9001          127.0.0.1:54909         ESTABLISHED 4869/java           keepalive (2445.40/0/0) tcp        0      0 my.ser.ver.ip:56654    45.125.34.159:6969      ESTABLISHED 27006/XDTQK         off (0.00/0/0)  I tried killing them using kill with their PID one by one but after some time they came up again. So I checked my cron, and there were some entries there that I didn't do so I clear them as well. I compared the crons with a new box I just launched. I disabled the root login, created another sudoer with pem file instead. Now I need to find a way to clean this once and for all and I lack experience. Can anyone please help me out? Thanks in advance
122963
A few weeks ago, my machine (lets call it "main") was logged into wirelessly from an unauthorized host, probably using ssh.  I did not detect the intrusion until a few days ago, and my machine is completely shut down.  I found the login using this line from last:  myusername    pts/1        ipad             Tue Oct 15 22:23 - 22:25  (00:02)   Needless to say, not only does no one in my family own an iPad, but almost none of my friends do, either.  This makes me suspect that whoever was behind this changed the hostname of their machine.  Additionally, I discovered this line in the last output on another machine of mine ("secondary"):  myusername    pts/2        :0               Tue Oct 15 22:23 - 22:23  (00:00)   This line coincides with the timestamp from main, which has password-less ssh access (through keys) to secondary.  Is it possible that whoever broke in to main has also rooted secondary?  How can I prevent this from happening again?  Are there logs that I can look through to determine exactly how main was accessed (I am the only user on the system and have a very strong password)?  Is it at all possible that this is just a weird bug that occurred?  Should I, and where should I start looking for rootkits and/or keyloggers?  In short, what should I do?
13024
Why are the accountsd and securityd processes using so much CPU on OS X 10.10.3? I am on a Early 2011 Macbook Pro.  What are these processes for? Is it safe to kill them? The machine has only been up 4 hours so has been rebooted recently.
83812
I stupidly ran sudo rm /* followed by sudo rm -R /*  My sites still run, although the vast majority of commands like ls are now broken.  Is there a simple way to get data off the server or reverse some of damage?
92269
I've consistently had a problem where "ipconfig /flushdns" + restarting computer doesn't get rid of all the DNS records.  Should it completely flush any and all records in DNS? Why doesn't it usually happen like this? Is there some kind of restriction?
77726
I run a medium-sized Nagios server. It monitors roughly 40 servers with 180 services currently and is only growing by the day.  I migrated from an old Nagios setup that was configured in a very esoteric fashion, forcing me to reconfigure everything from scratch.  Now that the server is running and works for most of what we need it for, I'm looking into making it a bit more scalable; currently each hosts is its own file in /etc/nagios/hosts/, and each host has all of its services in the same file. This is obviously not optimal, but neither is obfuscating all of my configuration into hundreds of different files.  So my question is this: to any experienced Nagios admins out there, what is the best way to make use of hostgroups/servicegroups without over-complicating the configuration?
3686
I need to check CPU and memory usage for the server in java, anyone know how it could be done?
9793
My web server periodically comes under attack, and I get a bunch of requests that look like  /my.page?union+all+select+0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536--  Are there simple command line tools to decode this?
32262
When I connect to my server (ubuntu server 10.10), I get this:  name@server-name.belkin ~&gt;   How can I remove ".belkin"?
109178
Is there a way to know who is pinging my PC on my network? Is it possible to monitor all ICMP packets? How can I do that?
66895
I was at school SSHing to my homebox. All of a sudden, my connection was closed. Attempting to reconnect failed. When I returned home, I discovered that my computer was off.  Nobody was at my house and I am sure that I did not have a power outage.  How can I figure out how or why my computer shut off? Is there some log in /var/log that could point me in the right direction? Should there be a core dump somewhere that I should find? If so, how do I use core dumps?
537
I have a process which listen to 2 ports : 45136/tcp and 37208/udp (actually I assume it is the same process). But netstat doesn't return any pid :  netstat -antlp | grep 45136 tcp        0      0 0.0.0.0:45136           0.0.0.0:*           LISTEN      -    Same result with "grep 37208".  I tried lsof too :  lsof -i TCP:45136   But it doesn't return anything.  It's a new installation of squeeze and I really don't know what could be this process. Any idea ?  ANSWER Thanks to your comments I found out what it was. I deinstalled nfs-server nfs-common (after a dkpg --get-selections | grep nfs search) and the unknown process disapeared. Strange though that kernel processes aren't marked in any way.  Thanks again to both of you. ;)
43239
Recently, My SSH log summaries for my Ubuntu 12.04 servers in Logwatch have started showing entries for "11: Normal Shutdown, Thank you for playing [preauth]" along with the "11: Bye Bye [preauth]" and "11: disconnected by user" messages they had been showing previously.  I have not seen this message in my logs before the past few weeks, nor have I seen it on my older servers which are stuck on Ubuntu 10.04. I have googled this message and can't find any clear explanations there either.  The IPs attempting to login and receiving this message are random hack attempts, and judging from the preauth I assume (hope) they are not successful, but I would like to know exactly what this message means and how it differs from others to be sure.  EDIT for additional information: My servers have password authentication and root authentication both disabled
29672
My server has slowed down, and I don't know why.  Print from top:  top - 14:32:50 up 639 days,  6:30,  1 user,  load average: 67.93, 70.63, 79.85 Tasks: 245 total,   1 running, 244 sleeping,   0 stopped,   0 zombie Cpu(s):  3.9% us,  0.5% sy,  0.0% ni, 94.5% id,  1.0% wa,  0.0% hi,  0.0% si Mem:   1034784k total,  1021256k used,    13528k free,     4360k buffers Swap:  1023960k total,   635752k used,   388208k free,    36632k cached   vmstat 10 6  procs -----------memory---------- ---swap-- -----io---- --system-- ----cpu----  r  b   swpd   free   buff  cache   si   so    bi    bo   in    cs us sy id wa  0 110 795604  12328   3980  46676    0    0     0     0    0     0  4  1 95  1  0 97 788848  12052   3960  46256 2985   33  3323    33  429     0  2  1  0 97  0 119 782660  13992   4096  45740 2780   14  2995   360  435     0  2  1  1 96  0 121 775924  15600   3724  42796 3084    0  3443   136  440     0  2  1  0 98  0 113 769392  13576   3476  41968 3002    0  3458     7  426     0  2  1  0 97  0 113 762284  12440   3332  34884 3151    0  3553    61  427     0  2  1  0 97   doitprod2:/var/log# grep -c processor /proc/cpuinfo  2   iostat 2   tps   Blk_czyt/s   Blk_zapis/s  Blk_czyt   Blk_zapis sda             166,00      7128,00        52,00      14256        104     Ok, after kill and start some processes is now fine. Thx for Your help anyway.
111478
Everytime my server reboots it seems I have to reset my iptables to default, I used to use firestarter but removed it a while ago. Is there any settings that are making iptables change when the server reboots?
162
How to check the opened/closed ports on my computer?  I used netstat -a on command line.   Does the port status "LISTENING" indicate that the port is open? Is any port, that is not shown in the output, closed?
56639
#!/bin/bash  SUBJECT="WARNING CPU USAGE HIGH" TO=gmail id MESSAGE=/tmp/messages echo "#######################" &gt; $MESSAGE echo "CPU statistics as follows.." &gt;&gt; $MESSAGE mpstat &gt;&gt; $MESSAGE echo "#######################" &gt;&gt; $MESSAGE CPU_USAGE=$(top -b -n1 | awk '/^Cpu/ {print $2}' | cut -d. -f1) [ $CPU_USAGE -gt 85 ] &amp;&amp; mail -s "$SUBJECT" "$TO" &lt; $MESSAGE`   ./cpu.sh: line 11: [: -gt: unary operator expected What might be the reason
14660
What are the meaning of the TIME_WAIT when using netstat of my web server process? I am sure the web server is not over loaded.  tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      15655/apache2 tcp        0      0 x.x.x.x:80       123.125.66.35:19667     SYN_RECV    - tcp        0      0 x.x.x.x:80       113.138.59.140:12186    TIME_WAIT   - tcp        0      0 x.x.x.x:80       66.249.67.121:59493     ESTABLISHED 23702/apache2 tcp        0      0 x.x.x.x:80       69.28.51.206:40652      TIME_WAIT   - tcp        0      0 x.x.x.x:80       221.126.149.99:51877    TIME_WAIT   - tcp        0      0 x.x.x.x:80       221.126.149.99:51872    TIME_WAIT   - tcp        0      0 x.x.x.x:80       123.125.66.19:13084     TIME_WAIT   -