From owner-freebsd-questions@FreeBSD.ORG Fri Oct 12 07:44:14 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EBA3B16A418 for ; Fri, 12 Oct 2007 07:44:14 +0000 (UTC) (envelope-from cyberleo@cyberleo.net) Received: from pizzabox.cyberleo.net (alpha.cyberleo.net [198.145.45.10]) by mx1.freebsd.org (Postfix) with ESMTP id AE15413C457 for ; Fri, 12 Oct 2007 07:44:14 +0000 (UTC) (envelope-from cyberleo@cyberleo.net) Received: (qmail 23674 invoked from network); 12 Oct 2007 07:44:11 -0000 Received: from adsl-75-3-116-182.dsl.chcgil.sbcglobal.net (HELO ?172.16.44.14?) (cyberleo@cyberleo.net@75.3.116.182) by alpha.cyberleo.net with ESMTPA; 12 Oct 2007 07:44:11 -0000 Message-ID: <470F25BF.1000805@cyberleo.net> Date: Fri, 12 Oct 2007 02:43:59 -0500 From: CyberLeo Kitsana User-Agent: Thunderbird 2.0.0.6 (X11/20070819) MIME-Version: 1.0 To: Zbigniew Szalbot References: <9e83978cc36db6e49da9d81ac8e300ac@szalbot.homedns.org> In-Reply-To: <9e83978cc36db6e49da9d81ac8e300ac@szalbot.homedns.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: Freebsd questions Subject: Re: uid 80: exited on signal 6 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Oct 2007 07:44:15 -0000 Zbigniew Szalbot wrote: > szalbot.homedns.org kernel log messages: +++ /tmp/security.BfIqepKO Fri Oct > 12 03:08:35 2007 > +pid 82543 (httpd), uid 80: exited on signal 6 > +pid 82542 (httpd), uid 80: exited on signal 6 > +pid 82541 (httpd), uid 80: exited on signal 6 > +pid 82537 (httpd), uid 80: exited on signal 6 > +pid 82533 (httpd), uid 80: exited on signal 6 > +pid 82536 (httpd), uid 80: exited on signal 6 > +pid 82535 (httpd), uid 80: exited on signal 6 > +pid 82534 (httpd), uid 80: exited on signal 6 > +pid 3653 (httpd), uid 80: exited on signal 6 This means that the httpd child processes are crashing, most likely in response to a request. Because apache creates child processes dynamically to handle load (at least, with the default MPM) these crashed processes are automatically replaced, and the server continues happily servicing requests. It might be a good idea to go through your access and error logs and see if there are any suspicious-looking or unusually long requests that might be trying to exploit a buffer overflow vulnerability in apache or a module thereof. If you are using mod_php, though, it's more likely that it's a bug in PHP or a PHP extension that's being flushed out by some rarely used script on your server. -- Fuzzy love, -CyberLeo Technical Administrator CyberLeo.Net Webhosting http://www.CyberLeo.Net Furry Peace! - http://wwww.fur.com/peace/