From owner-freebsd-current@FreeBSD.ORG Wed Oct 6 06:43:41 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2F1B216A4CE for ; Wed, 6 Oct 2004 06:43:41 +0000 (GMT) Received: from hex.athame.co.uk (guru164.netsonic.fi [194.29.193.164]) by mx1.FreeBSD.org (Postfix) with ESMTP id CE02B43D1D for ; Wed, 6 Oct 2004 06:43:40 +0000 (GMT) (envelope-from andy@athame.co.uk) Received: from hex.int.athame.co.uk ([192.168.1.1] helo=localhost) by hex.athame.co.uk with esmtp (Exim 4.42 (FreeBSD)) id 1CF5WV-0001jT-Lx; Wed, 06 Oct 2004 09:43:39 +0300 From: Andy Fawcett To: freebsd-current@freebsd.org Date: Wed, 6 Oct 2004 09:43:34 +0300 User-Agent: KMail/1.7 References: <20041006041104.GK15774@atlantis.ccs.neu.edu> <044d01c4ab6a$4b1f44c0$0500a8c0@home> In-Reply-To: <044d01c4ab6a$4b1f44c0$0500a8c0@home> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200410060943.37506.andy@athame.co.uk> cc: freebsd Subject: Re: BETA6 kern.maxfiles messages X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Oct 2004 06:43:41 -0000 On Wednesday 06 October 2004 09:04, freebsd wrote: > I'm suspicious someone was trying to probe or dos this server, but if > there is some other possible explanation, and since I have only seen > this on a 5.3 BETA box I thought I would post it here. It looks to > me like someone was trying to do a small dos attack perhaps? > > Today I had these messages in dmesg.today: > > kern.maxfiles limit exceeded by uid 70, please see tuning(7). > kern.maxfiles limit exceeded by uid 88, please see tuning(7). ^^^ > > The offending processes are: > # ps 88 > PID TT STAT TIME COMMAND > 88 ?? IL 0:00.00 [nfsiod 3] > # ps 70 > PID TT STAT TIME COMMAND > 70 ?? WL 0:08.60 [swi3: cambio] You shouldn't be looking at process IDs, but you should be looking at User IDs. Users 70 and 88 are (or at least should be) for PostgreSQL and MySQL. A. -- Andy Fawcett | andy@athame.co.uk | tap@kde.org "In an open world without walls and fences, | tap@lspace.org we wouldn't need Windows and Gates." -- anon | tap@fruitsalad.org