From owner-freebsd-questions@FreeBSD.ORG Fri Sep 14 20:35:20 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 92C6516A417 for ; Fri, 14 Sep 2007 20:35:20 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from mail-out4.apple.com (mail-out4.apple.com [17.254.13.23]) by mx1.freebsd.org (Postfix) with ESMTP id 870B413C459 for ; Fri, 14 Sep 2007 20:35:20 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from relay14.apple.com (relay14.apple.com [17.128.113.52]) by mail-out4.apple.com (Postfix) with ESMTP id 3733C11B7D0D; Fri, 14 Sep 2007 13:35:20 -0700 (PDT) Received: from relay14.apple.com (unknown [127.0.0.1]) by relay14.apple.com (Symantec Mail Security) with ESMTP id 18CD02805E; Fri, 14 Sep 2007 13:35:20 -0700 (PDT) X-AuditID: 11807134-aa249bb000003598-31-46eaf0871bd4 Received: from [17.214.13.96] (cswiger1.apple.com [17.214.13.96]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by relay14.apple.com (Apple SCV relay) with ESMTP id F067328092; Fri, 14 Sep 2007 13:35:19 -0700 (PDT) In-Reply-To: <0b9d01c7f6f1$6ecedb30$6400a8c0@msdi.local> References: <0b9d01c7f6f1$6ecedb30$6400a8c0@msdi.local> Mime-Version: 1.0 (Apple Message framework v752.2) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <880CEEF8-EC4C-4E28-AAB6-2E1F85B1B5DA@mac.com> Content-Transfer-Encoding: 7bit From: Chuck Swiger Date: Fri, 14 Sep 2007 13:35:19 -0700 To: Ian Lord X-Mailer: Apple Mail (2.752.2) X-Brightmail-Tracker: AAAAAA== Cc: freebsd-questions@freebsd.org Subject: Re: kernel log messages X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Sep 2007 20:35:20 -0000 On Sep 14, 2007, at 10:05 AM, Ian Lord wrote: > +++ /tmp/security.iwonKikI Thu Sep 13 03:02:27 2007 > > +pid 85092 (httpd), uid 80: exited on signal 11 pid 85097 (httpd), uid > +80: exited on signal 11 pid 85099 (httpd), uid 80: exited on > signal 11 > +pid 85091 (httpd), uid 80: exited on signal 11 pid 85090 (httpd), uid > +80: exited on signal 11 pid 85094 (httpd), uid 80: exited on > signal 11 > [ ... ] > Is this something I should care about ? First time I see this, and > since the > os mention it to me, I guess it's something important :-) Well, it could indicate something going wrong with your hardware-- failing memory or an overheating CPU would tend to make long-running daemon processes die. However, it can also indicate that there was a bug in Apache or one of the modules which is being exposed by the incoming requests. In some cases, that may mean that someone malicious is trying to exploit a security problem. You might want to run portaudit and check to make sure you're current.... -- -Chuck