Date: Wed, 6 Oct 2004 09:43:34 +0300 From: Andy Fawcett <andy@athame.co.uk> To: freebsd-current@freebsd.org Cc: freebsd <freebsd@paymentonline.net> Subject: Re: BETA6 kern.maxfiles messages Message-ID: <200410060943.37506.andy@athame.co.uk> In-Reply-To: <044d01c4ab6a$4b1f44c0$0500a8c0@home> References: <20041006041104.GK15774@atlantis.ccs.neu.edu> <044d01c4ab6a$4b1f44c0$0500a8c0@home>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wednesday 06 October 2004 09:04, freebsd wrote:
> I'm suspicious someone was trying to probe or dos this server, but if
> there is some other possible explanation, and since I have only seen
> this on a 5.3 BETA box I thought I would post it here. It looks to
> me like someone was trying to do a small dos attack perhaps?
>
> Today I had these messages in dmesg.today:
>
> kern.maxfiles limit exceeded by uid 70, please see tuning(7).
> kern.maxfiles limit exceeded by uid 88, please see tuning(7).
^^^
>
> The offending processes are:
> # ps 88
> PID TT STAT TIME COMMAND
> 88 ?? IL 0:00.00 [nfsiod 3]
> # ps 70
> PID TT STAT TIME COMMAND
> 70 ?? WL 0:08.60 [swi3: cambio]
You shouldn't be looking at process IDs, but you should be looking at
User IDs.
Users 70 and 88 are (or at least should be) for PostgreSQL and MySQL.
A.
--
Andy Fawcett | andy@athame.co.uk
| tap@kde.org
"In an open world without walls and fences, | tap@lspace.org
we wouldn't need Windows and Gates." -- anon | tap@fruitsalad.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200410060943.37506.andy>