<div dir="ltr">any idea?<br><br><div class="gmail_quote">On Tue, May 29, 2012 at 4:12 PM, Alex Savenok <span dir="ltr"><<a href="mailto:sawenok@gmail.com" target="_blank">sawenok@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Hi!<br><br>I found today that my server was out of disk space<br><br>The log file /var/log/secure was pumped up with tons of messages like:<br>...<br><span style="font-family:courier new,monospace">May 29 08:52:28 svm211 tcpd[27023]: connect from unknown (unknown)</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">May 29 08:52:28 svm211 tcpd[27023]: connect from unknown (unknown)</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">May 29 08:52:28 svm211 tcpd[27023]: connect from unknown (unknown)</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">May 29 08:52:28 svm211 tcpd[27023]: connect from unknown (unknown)</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">May 29 08:52:28 svm211 tcpd[27023]: connect from unknown (unknown)</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">May 29 08:52:28 svm211 tcpd[27023]: connect from unknown (unknown)</span><br>...<br><br>The top -c command shows me that <span style="font-family:courier new,monospace">/spider/src/client <span style="font-family:arial,helvetica,sans-serif">eating CPU:</span></span><br>
<br><span style="font-family:courier new,monospace"> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">31518 root 20 0 6180 300 228 R 46.2 0.0 6575:03 tcpd /spider/src/client login telnet</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">31460 root 20 0 6152 448 360 R 44.2 0.0 6579:07 tcpd /spider/src/client login telnet</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">27023 root 20 0 8388 756 624 R 43.9 0.0 6846:06 tcpd /spider/src/client login telnet</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">27024 root 20 0 8 4 0 R 42.9 0.0 6844:32 [tcpd]</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">27025 root 20 0 8388 752 624 R 42.2 0.0 6844:06 tcpd /spider/src/client login telnet</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">27026 root 20 0 8388 756 624 R 41.9 0.0 6844:47 tcpd /spider/src/client login telnet</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">31442 root 20 0 6152 516 412 R 41.9 0.0 6580:27 tcpd /spider/src/client login telnet</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">27022 root 20 0 8388 752 624 R 41.6 0.0 6845:01 tcpd /spider/src/client login telnet</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">31483 root 20 0 272 88 60 R 41.6 0.0 6575:51 tcpd /spider/src/client login telnet</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace"> 912 root 20 0 242m 1300 736 S 10.9 0.0 2726:00 /sbin/rsyslogd -i /var/run/syslogd.pid -c 4</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace"> 1344 cqplanet 20 0 215m 62m 2624 S 1.0 2.1 584:20.95 /usr/bin/perl -w /spider/perl/<a href="http://cluster.pl" target="_blank">cluster.pl</a></span><br>
<br>Currently I killed all clients, but how to prevent this in the future? <br>Why does it happen? <br><br>Thanks!<br>Alex, sysop of 4z5lz-2<br></div>
</blockquote></div><br></div>