DOS ATTACKE ODER WAS soll ich jetzt tun ???

Apache, Lighttpd, nginx, Cherokee
Post Reply
xtramen
Posts: 90
Joined: 2005-08-07 14:27
 

DOS ATTACKE ODER WAS soll ich jetzt tun ???

Post by xtramen »

Hallo Leute,

habe mal mit "free" meinen RAM geprüft.
Und hab folgendes Ergebnis bekommen:

total used free shared buffers cached
Mem 505108 487492 17616 0 38900 247088
-+ bufferscache 201504 303604
Swap 530136 55240 474896

Habe nun mit Top alle laufenden Protzesse angezeigt und siehe da die CPU ist zu 99,9 % ausgelastet.

Seht euch das mal an, was soll ich den jetzt tun ??:

7889 wwwrun 25 0 5352 1508 4660 R 99.9 0.3 4734:06 sendmail
23838 root 17 0 1972 948 1764 R 0.3 0.2 0:00.42 top
1 root 16 0 596 80 452 S 0.0 0.0 0:01.44 init
2 root RT 0 0 0 0 S 0.0 0.0 0:00.29 migration/0
3 root 34 19 0 0 0 S 0.0 0.0 0:00.01 ksoftirqd/0
4 root RT 0 0 0 0 S 0.0 0.0 0:00.24 migration/1
5 root 34 19 0 0 0 S 0.0 0.0 0:00.30 events/0
Top
alexander newald
Posts: 1117
Joined: 2002-09-27 00:54
Location: Hannover
Contact:
Contact alexander newald
 

Re: DOS ATTACKE ODER WAS soll ich jetzt tun ???

Post by alexander newald »

Die Ergebnisse in CODE Tags posten, ist leserlicher:

pstree
mailq|wc -l
Top
xtramen
Posts: 90
Joined: 2005-08-07 14:27
 

Re: DOS ATTACKE ODER WAS soll ich jetzt tun ???

Post by xtramen »

Hallo da kommt nur das raus:

Code: Select all

initââ¬âcron
     ââevents/0ââ¬âaio/1
     â          ââata/0
     â          ââkblockd/1
     â          ââkhelper
     â          âânetlink/1
     â          ââ2*[pdflush]
     ââevents/1ââ¬âaio/0
     â          ââata/1
     â          ââkblockd/0
     â          âânetlink/0
     ââhttpd2-preforkââ¬âhttpd2-preforkâââsendmail
     â                ââ10*[httpd2-prefork]
     â                ââpipelog.pl
     ââhwscand
     ââkhubd
     ââkirqd
     ââkjournald
     ââklogd
     ââkseriod
     ââksoftirqd/0
     ââksoftirqd/1
     ââkswapd0
     ââmigration/0
     ââmigration/1
     ââ6*[mingetty]
     ââmysqld_safeâââmysqld-max
     âânscd
     ââresmgrd
     ââsaslauthdâââ4*[saslauthd]
     ââscsi_eh_0
     ââscsi_eh_1
     ââ2*[sendmailâââsendmail]
     ââspamdâââ5*[spamd]
     ââsshdââ¬â2*[sshdâââsftp-server]
     â      ââsshdâââbash
     â      ââsshdâââbashâââpstree
     ââsyslogd
     ââudevd
     ââxinetd
Und bei mailq|wc -l kommt dann eine Zahl: 27

Ich versuch das mal händisch und mach das mal bis zur ersten Zeile die mich ja so beunruhigt:

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME COMMAND
7889 wwwrun 25 0 5352 1508 4660 R 99,9 0.3 4783:57 Sendmail

Gruss und Danke
Top
alexander newald
Posts: 1117
Joined: 2002-09-27 00:54
Location: Hannover
Contact:
Contact alexander newald
 

Re: DOS ATTACKE ODER WAS soll ich jetzt tun ???

Post by alexander newald »

Wähl mal bei deinem SSH Client einen richtigen Zeichensatz.

Das ist evtl. nicht ok:

httpd2-prefork
httpd2-prefork sendmail

mach mail ein

tail -n 30 /var/log/mail
tail -n 30 [apache access log bei dir]

evtl. Datenschutzrechtliche Daten aus X en
Top
xtramen
Posts: 90
Joined: 2005-08-07 14:27
 

Re: DOS ATTACKE ODER WAS soll ich jetzt tun ???

Post by xtramen »

Hallo und Danke,

da komt folgendes raus dabei:

Code: Select all

Aug 12 06:20:21 xxxxxxx sendmail[26184]: j78FUf2e005692: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+12:49:38, xdelay=00:00:00, mailer=esmtp, pri=15420668, relay=test.com., dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 06:26:39 xxxxxxx sendmail[26184]: j78FJut2003539: to=<casapalmera@hoitmail.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+13:06:41, xdelay=00:06:18, mailer=esmtp, pri=15420673, relay=hoitmail.com. [38.119.83.27], dsn=4.0.0, stat=Deferred: Connection timed out with hoitmail.com.
Aug 12 06:26:39 xxxxxxx sendmail[26184]: j78FM9HG003930: to=<casapalmera@hoitmail.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+13:04:27, xdelay=00:00:00, mailer=esmtp, pri=15420673, relay=hoitmail.com., dsn=4.0.0, stat=Deferred: Connection timed out with hoitmail.com.
Aug 12 06:44:03 xxxxxxx sendmail[26318]: j78FSQ9d005366: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+13:15:35, xdelay=00:00:00, mailer=esmtp, pri=15510664, relay=test.com., dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 06:44:03 xxxxxxx sendmail[26318]: j78FUXm0005656: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+13:13:28, xdelay=00:00:00, mailer=esmtp, pri=15510664, relay=test.com., dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 06:44:03 xxxxxxx sendmail[26318]: j78FSYjt005385: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+13:15:27, xdelay=00:00:00, mailer=esmtp, pri=15510668, relay=test.com., dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 06:44:03 xxxxxxx sendmail[26318]: j78FUf2e005692: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+13:13:20, xdelay=00:00:00, mailer=esmtp, pri=15510668, relay=test.com., dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 06:44:03 xxxxxxx sendmail[26318]: j78FJut2003539: to=<casapalmera@hoitmail.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+13:24:05, xdelay=00:00:00, mailer=esmtp, pri=15510673, relay=hoitmail.com., dsn=4.0.0, stat=Deferred: Connection timed out with hoitmail.com.
Aug 12 06:44:03 xxxxxxx sendmail[26318]: j78FM9HG003930: to=<casapalmera@hoitmail.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+13:21:51, xdelay=00:00:00, mailer=esmtp, pri=15510673, relay=hoitmail.com., dsn=4.0.0, stat=Deferred: Connection timed out with hoitmail.com.
Aug 12 07:20:21 xxxxxxx sendmail[26449]: j78FSQ9d005366: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+13:51:53, xdelay=00:06:18, mailer=esmtp, pri=15600664, relay=test.com. [208.48.34.132], dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 07:20:21 xxxxxxx sendmail[26449]: j78FUXm0005656: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+13:49:46, xdelay=00:00:00, mailer=esmtp, pri=15600664, relay=test.com., dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 07:20:21 xxxxxxx sendmail[26449]: j78FSYjt005385: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+13:51:45, xdelay=00:00:00, mailer=esmtp, pri=15600668, relay=test.com., dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 07:20:21 xxxxxxx sendmail[26449]: j78FUf2e005692: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+13:49:38, xdelay=00:00:00, mailer=esmtp, pri=15600668, relay=test.com., dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 07:26:39 xxxxxxx sendmail[26449]: j78FJut2003539: to=<casapalmera@hoitmail.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+14:06:41, xdelay=00:06:18, mailer=esmtp, pri=15600673, relay=hoitmail.com. [38.119.83.27], dsn=4.0.0, stat=Deferred: Connection timed out with hoitmail.com.
Aug 12 07:26:39 xxxxxxx sendmail[26449]: j78FM9HG003930: to=<casapalmera@hoitmail.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+14:04:27, xdelay=00:00:00, mailer=esmtp, pri=15600673, relay=hoitmail.com., dsn=4.0.0, stat=Deferred: Connection timed out with hoitmail.com.
Aug 12 07:44:03 xxxxxxx sendmail[26586]: j78FSQ9d005366: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+14:15:35, xdelay=00:00:00, mailer=esmtp, pri=15690664, relay=test.com., dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 07:44:03 xxxxxxx sendmail[26586]: j78FUXm0005656: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+14:13:28, xdelay=00:00:00, mailer=esmtp, pri=15690664, relay=test.com., dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 07:44:03 xxxxxxx sendmail[26586]: j78FSYjt005385: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+14:15:27, xdelay=00:00:00, mailer=esmtp, pri=15690668, relay=test.com., dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 07:44:03 xxxxxxx sendmail[26586]: j78FUf2e005692: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+14:13:20, xdelay=00:00:00, mailer=esmtp, pri=15690668, relay=test.com., dsn=4.0.0, stat=Deferred: Connection timed out with test.com.
Aug 12 07:44:03 xxxxxxx sendmail[26586]: j78FJut2003539: to=<casapalmera@hoitmail.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+14:24:05, xdelay=00:00:00, mailer=esmtp, pri=15690673, relay=hoitmail.com., dsn=4.0.0, stat=Deferred: Connection timed out with hoitmail.com.
Aug 12 07:44:03 xxxxxxx sendmail[26586]: j78FM9HG003930: to=<casapalmera@hoitmail.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8), delay=3+14:21:51, xdelay=00:00:00, mailer=esmtp, pri=15690673, relay=hoitmail.com., dsn=4.0.0, stat=Deferred: Connection timed out with hoitmail.com.
Aug 12 07:55:27 xxxxxxx sendmail[26656]: j7C5tMTo026656: from=<Kri@fugmann.com>, size=4042, class=0, nrcpts=1, msgid=<200508120555.j7C5tMTo026656@xxxxxxx.xxxxxxx.de>, proto=SMTP, daemon=MTA, relay=218-101-44-160.paradise.net.nz [218.101.44.160]
Aug 12 07:55:29 xxxxxxx spamd[7182]: connection from localhost [127.0.0.1] at port 48206
Aug 12 07:55:29 xxxxxxx spamd[7182]: processing message <200508120555.j7C5tMTo026656@xxxxxxx.xxxxxxx.de> for web1p2:0.
Aug 12 07:55:29 xxxxxxx spamd[7182]: clean message (1.5/5.0) for web1p2:0 in 0.1 seconds, 4401 bytes.
Aug 12 07:55:29 xxxxxxx spamd[7182]: result: .  1 - HTML_80_90,HTML_MESSAGE,MSGID_FROM_MTA_ID scantime=0.1,size=4401,mid=<200508120555.j7C5tMTo026656@xxxxxxx.xxxxxxx.de>,autolearn=no
Aug 12 07:55:29 xxxxxxx sendmail[26657]: j7C5tMTo026656: to=<info@xony.de>, delay=00:00:03, xdelay=00:00:02, mailer=local, pri=34328, dsn=2.0.0, stat=Sent
Aug 12 08:07:59 xxxxxxx popper[26740]: Stats: web1p2 2 8079 0 0 dsl-084-056-145-185.arcor-ip.net 84.56.145.185 [pop_updt.c:296]
Aug 12 08:08:01 xxxxxxx popper[26741]: Stats: web1p2 0 0 0 0 dsl-084-056-145-185.arcor-ip.net 84.56.145.185 [pop_updt.c:296]
Aug 12 08:08:01 xxxxxxx popper[26742]: Stats: web1p2 0 0 0 0 dsl-084-056-145-185.arcor-ip.net 84.56.145.185 [pop_updt.c:296]
Apache Acces Log:

Code: Select all

84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/images/header_button_left_on.gif HTTP/1.1" 200 49 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/images/xe_logo.gif HTTP/1.1" 200 1055 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/images/header_button_right_on.gif HTTP/1.1" 200 64 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/images/header_button_right_off.gif HTTP/1.1" 200 848 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/images/header_button_left_off.gif HTTP/1.1" 200 51 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/images/abschluss.gif HTTP/1.1" 200 45 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/images/bullet2.gif HTTP/1.1" 200 65 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/images/xe_04.gif HTTP/1.1" 200 174 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/images/xe_06.gif HTTP/1.1" 200 112 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/images/xe_07.gif HTTP/1.1" 200 91 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/images/plu.gif HTTP/1.1" 200 65 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/stylesheet.css HTTP/1.1" 200 15532 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/images/ok.gif HTTP/1.1" 200 65 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/languages/german/images/buttons/button_quick_find.gif HTTP/1.1" 200 81 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /produkt_bilder/mac_kl.jpg HTTP/1.1" 200 4996 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /produkt_bilder/mc1_kl.jpg HTTP/1.1" 200 3792 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:39 +0200] "GET / HTTP/1.1" 200 68093 "http://forums.oscommerce.de/index.php?showtopic=32090" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/languages/german/images/buttons/button_buy_now.gif HTTP/1.1" 200 280 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:40 +0200] "GET /templates/dvd_store/languages/german/images/buttons/button_details_front.gif HTTP/1.1" 200 286 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:41 +0200] "GET /images/artikel_lesen.gif HTTP/1.1" 200 908 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:41 +0200] "GET /images/ant2_kl.jpg HTTP/1.1" 200 5248 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:41 +0200] "GET /produkt_bilder/macro_kl.jpg HTTP/1.1" 200 3268 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:41 +0200] "GET /produkt_bilder/lexku_kl.jpg HTTP/1.1" 200 2962 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:41 +0200] "GET /produkt_bilder/lex_kl.jpg HTTP/1.1" 200 3349 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:41 +0200] "GET /produkt_bilder/ad2_kl.jpg HTTP/1.1" 200 4797 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:41 +0200] "GET /produkt_bilder/adobe_kl.jpg HTTP/1.1" 200 3751 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:41 +0200] "GET /produkt_bilder/ant2_kl.jpg HTTP/1.1" 200 3576 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:41 +0200] "GET /templates/dvd_store/languages/german/images/buttons/button_login.gif HTTP/1.1" 200 297 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:41 +0200] "GET /templates/dvd_store/images/dash.gif HTTP/1.1" 200 50 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:42 +0200] "GET /images/stars_5.gif HTTP/1.1" 200 294 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:42 +0200] "GET /images/pixel_trans.gif HTTP/1.1" 200 43 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:42 +0200] "GET /templates/dvd_store/images/callback.gif HTTP/1.1" 200 2499 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:42 +0200] "GET /images/macro_kl.jpg HTTP/1.1" 200 3849 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:42 +0200] "GET /templates/dvd_store/languages/english/images/icon.gif HTTP/1.1" 200 1115 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:42 +0200] "GET /templates/dvd_store/languages/german/images/icon.gif HTTP/1.1" 200 710 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:42 +0200] "GET /templates/dvd_store/images/header_button_bg_on.gif HTTP/1.1" 200 48 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:42 +0200] "GET /templates/dvd_store/images/header_button_bg_off.gif HTTP/1.1" 200 49 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:42 +0200] "GET /templates/dvd_store/images/xe_05.gif HTTP/1.1" 200 272 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:42 +0200] "GET /templates/dvd_store/images/catbg.gif HTTP/1.1" 200 72 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:42 +0200] "GET /images/xxxxxx-banner.gif HTTP/1.1" 200 19168 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
84.131.116.212 - - [12/Aug/2005:04:16:59 +0200] "GET /templates/dvd_store/images/catbg2.gif HTTP/1.1" 200 72 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
68.142.251.130 - - [12/Aug/2005:04:21:43 +0200] "GET /robots.txt HTTP/1.0" 404 1053 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"
68.142.251.189 - - [12/Aug/2005:04:21:44 +0200] "GET /catalog/product_info.php?cPath=4_14&products_id=1190 HTTP/1.0" 404 1053 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"
213.39.224.166 - - [12/Aug/2005:04:21:58 +0200] "GET /templates/dvd_store/images/xe_logo.gif HTTP/1.1" 200 1055 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
213.39.224.166 - - [12/Aug/2005:04:21:58 +0200] "GET /templates/dvd_store/images/header_button_left_on.gif HTTP/1.1" 200 49 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
213.39.224.166 - - [12/Aug/2005:04:21:58 +0200] "GET /templates/dvd_store/images/header_button_right_on.gif HTTP/1.1" 200 64 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
213.39.224.166 - - [12/Aug/2005:04:21:58 +0200] "GET /templates/dvd_store/images/header_button_left_off.gif HTTP/1.1" 200 51 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
213.39.224.166 - - [12/Aug/2005:04:21:58 +0200] "GET /templates/dvd_store/images/header_button_right_off.gif HTTP/1.1" 200 848 "http://demo.xxxxxx.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
mmmhhh warum meinst DU:

httpd2-prefork
httpd2-prefork sendmail

Was bedeutet das genau ?!

Ist das denn Normal das Sendmail schon so lange läuft ?!

Gruss
Last edited by xtramen on 2005-08-12 11:19, edited 1 time in total.
Top
xtramen
Posts: 90
Joined: 2005-08-07 14:27
 

Re: DOS ATTACKE ODER WAS soll ich jetzt tun ???

Post by xtramen »

Ich habe jetzt mal das Email Postfach gelöscht und Confixx manuell geupdated und jetzt schint zumindest die CPU Auslastung wieder normal zu sein.

Jedenfalls ist der Prozess jetzt nicht mehr da.
Kann es sein das das Update Script von COnfixx hängenblieb oder einfach nur der Service ?!.

So wie ich das deute ist mein Arbeitsspeicher aber immer noch zu 98% ausgelastet. Oder wie soll ich das hier deuten:

Code: Select all

Mem:    505108k total,   470348k used,    34760k free,    75424k buffers
Swap:   530136k total,    53524k used,   476612k free,   189408k cached
Ich habe zudem festgestellt das seit Tagen versucht wurde eine Email an test@test.com zu versenden.

Vielleicht kann mir ja jemand bei der Deutung des Problems helfen damit ich das nächste mal nicht so hilflos da stehe.

DAnkeschön für die Unterstützung .

Gruss
Top
r00ty
Posts: 747
Joined: 2003-03-17 15:32
 

Re: DOS ATTACKE ODER WAS soll ich jetzt tun ???

Post by r00ty »

also das mit dem freien Speicher ist normal, dass du keinen hast. Linux verwendet freien Speicher zum Cachen und so, kann dies aber auch dynamisch freigeben falls ein anderes Programm den Speicher braucht.
zu dem test@test.com
sieht mir das eher so aus als würde dein Hoster testen ob du ein offenes Relay hast. Da dein Rechner sie nicht forwarded ist soweit auch alles in Ordnung....
Top
alexander newald
Posts: 1117
Joined: 2002-09-27 00:54
Location: Hannover
Contact:
Contact alexander newald
 

Re: DOS ATTACKE ODER WAS soll ich jetzt tun ???

Post by alexander newald »

Ich würde eher tippen, dass ein WebScript nicht richtig läuft

Code: Select all

Aug 12 07:44:03 xxxxxxx sendmail[26586]: j78FUf2e005692: to=<test@test.com>, ctladdr=<wwwrun@xxxxxxx.xxxxxxx.de> (30/8)...
Da die Mails nicht zustellbar sind, bleiben die auf deinem Server und Sendmail versucht die immer wieder zuzustellen.
Top
r00ty
Posts: 747
Joined: 2003-03-17 15:32
 

Re: DOS ATTACKE ODER WAS soll ich jetzt tun ???

Post by r00ty »

hmm joo stimmt, sendmail & wwwrun, sorry
dann ist das doch nicht so ohne, da würde ich mich mal drum kümmern
Top
Post Reply

Return to “Webserver”