my server have what i think is a suspicious activity, there is bash process that consume more than 30% cpu when i trace it with lsof -p it show:  COMMAND     PID USER   FD   TYPE   DEVICE SIZE/OFF    NODE NAME carcvncgi 39259 root  cwd    DIR    253,1     4096  813203 /var/www/elasticsearch carcvncgi 39259 root  rtd    DIR    253,1     4096       2 / carcvncgi 39259 root  txt    REG    253,1   625622 1109822 /usr/bin/carcvncgiw carcvncgi 39259 root    0u   CHR      1,3      0t0    1029 /dev/null carcvncgi 39259 root    1u   CHR      1,3      0t0    1029 /dev/null carcvncgi 39259 root    2u   CHR      1,3      0t0    1029 /dev/null carcvncgi 39259 root    3u  IPv4 36094970      0t0     UDP *:44932    but when i check it with who it only show :  USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT root     pts/4    182.253.177.249  09:07    6:45  17.35s  0.28s -bash root     pts/5    182.253.177.249  09:25   23:57   1.82s  1.75s iftop root     pts/7    182.253.177.249  09:33    5.00s  0.14s  0.00s w root     pts/0    103:S.0          22:45    9:29m  0.34s  0.27s /bin/bash   three from the top is my ip, the last one i think the provider ip.  is it possible someone accessing my server and hide it from who command ? is there a way to solve this? and what is carcvncgiw process as mr.Google doesn't provide clear explanation ?  UPDATE  well, I followed here  and try to deal with the server and 'solve the problem', but the question is remain is it possible to hide from who command and what is the carcvncgiw process?  note: thanks to the one show me that link, seems i need to purge my server then  UPDATE 2  Result of cat /proc/39259/cmdline  bash   Result of cat /proc/39259/environ  nSHLVL=0OLDPWD=/UPSTART_JOB=lokamedia-elasticTERM=linuxPATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/X11R6/binPWD=/var/www/elasticsearchNLSPATH=/usr/dt/lib/nls/msg/%L/%N.catXFILESEARCHPATH=/usr/dt/app-defaults/%L/Dt   Result of ls -lh /usr/bin/carcvncgiw  -rwxr-xr-x 1 root root 597K Mar 10 00:14 /usr/bin/carcvncgiw   thank you
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
Every few days I get notices on my MacBook that it's running or run out of hard drive space. Curiously, restarting the computer will enable me to recover gigabytes of space (this past time, it was able to recover about 2.2GB). However, I can't identify anything in my personal activity that consumed that space.  It's possible that it's a rogue iTunes podcast or a huge software update that my Mac is automatically downloading - would either of these reclaim the space upon a restart?  One possibility that I can think of is that FileVault has some sort of disk leak, allocating but not freeing files. Does this make sense? Is there a tool that I can run to determine where this space is going? Assuming it is FileVault, should I try to disable it? What's the best way to turn of FileVault on a nearly full computer? How do I delete my commands quickly? I use terminal for almost all tasks. Let's say I have entered a huge command like this:  sudo a-huge-command   What is the easiest way to delete the whole command with a single shortcut, rather than keep on hitting backspace key?  I'm a Ubuntu newbie looking to use Ubuntu in a professional way. Creating a default preamble Since I am using (almost) the same set up for my tex documents, I wonder if there is a way to create a preamble with my default packages and to recall it anytime I want to create a tex document.  If yes, how I can call this "default" preamble?  Thanks in advance Flawed proof that all positive integers are equal Inkscape filters are not rendering correctly I'm running Inkscape 0.92.4 on Ubuntu Linux 19.10. My graphics driver is from NVidia. I'm given to believe that Inkscape's filters should work and render fairly similarly to how filters work in GIMP. My expectations are based on this image which shows various filter effects which ship with Inkscape:    However, when I apply filters to even very simple shapes, I get horrible pixelated garbage like this:      Can anyone help me understand what is wrong and how to correct it? Thanks! iMac disk partion FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF and fusion drive unlinked How $\frac{1}{n}\sum_{i=1}^n X_i^2 - \bar X^2 = \frac{\sum_{i=1}^n (X_i - \bar X)^2}{n}$ How   $\frac{1}{n}\sum_{i=1}^n X_i^2 - \bar X^2 = \frac{\sum_{i=1}^n (X_i - \bar X)^2}{n}$   i have tried to do that by the following procedure:  $\frac{1}{n}\sum_{i=1}^n X_i^2 - \bar X^2$  =$\frac{1}{n}(\sum_{i=1}^n X_i^2 - n\bar X^2)$  =$\frac{1}{n}(\sum_{i=1}^n X_i^2 - \sum_{i=1}^n\bar X^2)$  =$\frac{1}{n} \sum_{i=1}^n (X_i^2 - \bar X^2)$  Then i have stumbled. I have a Minecraft 1.8.1 vanilla server and would like to reward certain users. I would like to /give some users a 99999/99999 durability renamed Diamond Pickaxe (with all enchantments on it). How do I use commands to change/repair the durability of items? If possible, using only one command and use /give. We know that $12^2 = 144$ and that $38^2 = 1444$. Are there any other perfect squares in the form of $\frac{13}{9} (10^n - 1) + 1$ (i.e. $1$ followed by $n$ $4$'s), and how would we prove it? Unknown Column In Where Clause Work out the type of c# application a class contained in a DLL is being used by System of linear equations having a real solution has also a rational solution. How can I prevent Overflow for the Gamma function? I have a Dirichlet distribution from which I'm maximizing $\alpha$ by calculating the log likelihood with the following equation  $p\left(s|\alpha\right) = \sum\limits_{i=1}^O\log\left(\frac{n_i!}{\prod\limits_{j=1}^kn_{ij}!}\frac{\Gamma\left(\alpha_0\right)}{\Gamma\left(\sum\limits_{j=1}^k\left(n_{ij}+a_j\right)\right)} \prod\limits_{j=1}^k \frac{\Gamma\left(n_{ij}+\alpha_j\right)}{\Gamma\left(\alpha_j\right)}\right)$  I have a python script to calculate the log likelihood. It works for small values, but when $n_{ij}$ gets high $\Gamma\left(\sum\limits_{j=1}^k\left(n_{ij}+a_j\right)\right)$ and $\Gamma\left(n_{ij}+\alpha_j\right)$ python runs into overflow error (the max for math.gamma is between 171 and 172).   Is there a way to change the likelihood function so that $\Gamma\left(\sum\limits_{j=1}^k\left(n_{ij}+a_j\right)\right)$ and $\Gamma\left(n_{ij}+\alpha_j\right)$ don't run into overflow errors. Can I just divide the values in $\Gamma$ by for example 100, if I then compare the likelihood between $p(s|\alpha)$ with different $\alpha$ values do the best $\alpha$ values still have the highest likelihood? Is there a symbol for "unitless"? Most efficient way to see if an ArrayList contains an object in Java I have an ArrayList of objects in Java.  The objects have four fields, two of which I'd use to consider the object equal to another.  I'm looking for the most efficient way, given those two fields, to see if the array contains that object.  The wrench is that these classes are generated based on XSD objects, so I can't modify the classes themselves to overwrite the .equals.    Is there any better way than just looping through and manually comparing the two fields for each object and then breaking when found?  That just seems so messy, looking for a better way.  Edit: the ArrayList comes from a SOAP response that is unmarshalled into objects. I need to print an image at a certain size. What dimensions and resolution should I use? (This question is meant to be a resource to direct others to given that this is a common question.)  Given the task of creating an image that will be printed at a certain size, what pixel dimensions and resolution should I be setting my file at? Where do I find system sounds? After installing gm-notify I see the option of hearing a sound every time a new e-mail arrives in my Gmail inbox, but I don't know where Ubuntu (10.4) stores the system sounds to assign one. Any ideas? Thanks. The limit of a sum $\sum_{k=1}^n \frac{n}{n^2+k^2}$ as $n\rightarrow\infty$ How to compute this limit:  $$\lim_{n\to\infty}\left(\frac{n}{n^2+1^2}+\frac{n}{n^2+2^2}+\cdots+\frac{n}{n^2+n^2}\right)$$  Please give me some hint. Installation of latest version R for linux First I typed  sudo gedit /etc/apt/sources.list   after that I got one sources list then I typed  deb http://cran.rstudio.com/bin/linux/debian wheezy-cran3/   then I get the error like this  No command 'deb' found, did you mean:  Command 'derb' from package 'icu-devtools' (main)  Command 'deb3' from package 'quilt' (main)  Command 'debc' from package 'devscripts' (main)  Command 'dwb' from package 'dwb' (universe)  Command 'xdeb' from package 'xdeb' (universe)  Command 'debi' from package 'devscripts' (main)  Command 'dab' from package 'bsdgames' (universe) deb: command not found   How should I proceed? Line of Bones to Travel and Conform to Curve (Train or snake following path) I've searched google extensively on this. Can't seem to find an answer.   I know about spline IK, which is wonderful for conforming a row of bones to a path. But combining the armature object with a follow path modifier causes the point of origin to move, but the bones themselves stick to the beginning of curve.   Ultimately my goal is to make a creature like a snake or centipede follow a curve path, thus animating it fairly realistically ...