Ubuntu中文论坛

致力于Ubuntu中文推广
http://forum.ubuntu.org.cn/

服务器每小时收到一次重启，被黑了？请大家看看！

http://forum.ubuntu.org.cn/viewtopic.php?t=224797

分页： 1 / 1

服务器每小时收到一次重启，被黑了？请大家看看！

发表于 ： 2009-09-04 11:20
由 simonlan
查看系统日志：

Aug 30 06:47:03 ubuntu syslogd 1.5.0#1ubuntu1: restart.
Aug 30 07:00:01 ubuntu exiting on signal 15
Aug 30 07:00:01 ubuntu syslogd 1.5.0#1ubuntu1: restart.
Aug 30 07:00:01 ubuntu kernel: Kernel logging (proc) stopped.
Aug 30 07:00:01 ubuntu kernel: Kernel log daemon terminating.
Aug 30 07:00:03 ubuntu kernel: Inspecting /boot/System.map-2.6.24-19-server
Aug 30 07:00:04 ubuntu kernel: Loaded 28743 symbols from /boot/System.map-2.6.24-19-server.
Aug 30 07:00:04 ubuntu kernel: Symbols match kernel version 2.6.24.
Aug 30 07:00:04 ubuntu kernel: Loaded 13023 symbols from 49 modules.
Aug 30 07:20:01 ubuntu -- MARK --
Aug 30 07:40:01 ubuntu -- MARK --
Aug 30 08:00:01 ubuntu exiting on signal 15
Aug 30 08:00:01 ubuntu syslogd 1.5.0#1ubuntu1: restart.
Aug 30 08:00:01 ubuntu kernel: Kernel logging (proc) stopped.
Aug 30 08:00:01 ubuntu kernel: Kernel log daemon terminating.
Aug 30 08:00:03 ubuntu kernel: Inspecting /boot/System.map-2.6.24-19-server
Aug 30 08:00:03 ubuntu kernel: Loaded 28743 symbols from /boot/System.map-2.6.24-19-server.
Aug 30 08:00:03 ubuntu kernel: Symbols match kernel version 2.6.24.
Aug 30 08:00:03 ubuntu kernel: Loaded 13023 symbols from 49 modules.
Aug 30 08:20:01 ubuntu -- MARK --
Aug 30 08:40:01 ubuntu -- MARK --
Aug 30 09:00:01 ubuntu -- MARK --
Aug 30 09:00:02 ubuntu exiting on signal 15
Aug 30 09:00:02 ubuntu syslogd 1.5.0#1ubuntu1: restart.
Aug 30 09:00:02 ubuntu kernel: Kernel logging (proc) stopped.
Aug 30 09:00:02 ubuntu kernel: Kernel log daemon terminating.
Aug 30 09:00:04 ubuntu kernel: Inspecting /boot/System.map-2.6.24-19-server
Aug 30 09:00:04 ubuntu kernel: Loaded 28743 symbols from /boot/System.map-2.6.24-19-server.
Aug 30 09:00:04 ubuntu kernel: Symbols match kernel version 2.6.24.
Aug 30 09:00:04 ubuntu kernel: Loaded 13023 symbols from 49 modules.
Aug 30 09:20:02 ubuntu -- MARK --
Aug 30 09:40:02 ubuntu -- MARK --
Aug 30 10:00:01 ubuntu exiting on signal 15
Aug 30 10:00:01 ubuntu syslogd 1.5.0#1ubuntu1: restart.
Aug 30 10:00:01 ubuntu kernel: Kernel logging (proc) stopped.
Aug 30 10:00:01 ubuntu kernel: Kernel log daemon terminating.
Aug 30 10:00:03 ubuntu kernel: Inspecting /boot/System.map-2.6.24-19-server
Aug 30 10:00:03 ubuntu kernel: Loaded 28743 symbols from /boot/System.map-2.6.24-19-server.
Aug 30 10:00:03 ubuntu kernel: Symbols match kernel version 2.6.24.
Aug 30 10:00:03 ubuntu kernel: Loaded 13023 symbols from 49 modules.
Aug 30 10:20:01 ubuntu -- MARK --
Aug 30 10:40:01 ubuntu -- MARK --
Aug 30 11:00:01 ubuntu -- MARK --
Aug 30 11:00:02 ubuntu exiting on signal 15
Aug 30 11:00:02 ubuntu syslogd 1.5.0#1ubuntu1: restart.
Aug 30 11:00:02 ubuntu kernel: Kernel logging (proc) stopped.
Aug 30 11:00:02 ubuntu kernel: Kernel log daemon terminating.
Aug 30 11:00:04 ubuntu kernel: Inspecting /boot/System.map-2.6.24-19-server
Aug 30 11:00:04 ubuntu kernel: Loaded 28743 symbols from /boot/System.map-2.6.24-19-server.
Aug 30 11:00:04 ubuntu kernel: Symbols match kernel version 2.6.24.
Aug 30 11:00:04 ubuntu kernel: Loaded 13023 symbols from 49 modules.
Aug 30 11:20:02 ubuntu -- MARK --
Aug 30 11:40:02 ubuntu -- MARK --
Aug 30 12:00:02 ubuntu exiting on signal 15
Aug 30 12:00:02 ubuntu syslogd 1.5.0#1ubuntu1: restart.
Aug 30 12:00:02 ubuntu kernel: Kernel logging (proc) stopped.
Aug 30 12:00:02 ubuntu kernel: Kernel log daemon terminating.
Aug 30 12:00:04 ubuntu kernel: Inspecting /boot/System.map-2.6.24-19-server
Aug 30 12:00:04 ubuntu kernel: Loaded 28743 symbols from /boot/System.map-2.6.24-19-server.
Aug 30 12:00:04 ubuntu kernel: Symbols match kernel version 2.6.24.
Aug 30 12:00:04 ubuntu kernel: Loaded 13023 symbols from 49 modules.
Aug 30 12:20:02 ubuntu -- MARK --
Aug 30 12:40:02 ubuntu -- MARK --
Aug 30 13:00:01 ubuntu exiting on signal 15
Aug 30 13:00:01 ubuntu syslogd 1.5.0#1ubuntu1: restart.
Aug 30 13:00:01 ubuntu kernel: Kernel logging (proc) stopped.
Aug 30 13:00:01 ubuntu kernel: Kernel log daemon terminating.
Aug 30 13:00:03 ubuntu kernel: Inspecting /boot/System.map-2.6.24-19-server
Aug 30 13:00:03 ubuntu kernel: Loaded 28743 symbols from /boot/System.map-2.6.24-19-server.
Aug 30 13:00:03 ubuntu kernel: Symbols match kernel version 2.6.24.
Aug 30 13:00:03 ubuntu kernel: Loaded 13023 symbols from 49 modules.

整点的lastcomm：

代码： 全选

cron              F  X root     ??         0.00 secs Fri Sep  4 11:00
sh               S     root     ??         0.00 secs Fri Sep  4 11:00
rotate.pl        S     root     ??         0.37 secs Fri Sep  4 11:00
sh                     root     ??         0.00 secs Fri Sep  4 11:00
klogd                  root     ??         0.00 secs Fri Sep  4 11:00
klogd                  root     ??         0.00 secs Fri Sep  4 11:00
klogd            S     klog     ??         0.00 secs Fri Sep  4 11:00
start-stop-daem   F    root     ??         0.00 secs Fri Sep  4 11:00
start-stop-daem        root     ??         0.00 secs Fri Sep  4 11:00
chown            S     root     ??         0.00 secs Fri Sep  4 11:00
mkfifo           S     root     ??         0.00 secs Fri Sep  4 11:00
chown            S     root     ??         0.01 secs Fri Sep  4 11:00
mkdir                  root     ??         0.00 secs Fri Sep  4 11:00
tput                   root     ??         0.01 secs Fri Sep  4 11:00
tput                   root     ??         0.00 secs Fri Sep  4 11:00
readlink               root     ??         0.00 secs Fri Sep  4 11:00
sleep                  root     ??         0.00 secs Fri Sep  4 11:00
klogd                  root     ??         0.00 secs Fri Sep  4 11:00
rm               S     root     ??         0.00 secs Fri Sep  4 11:00
dd               S   X root     ??         0.00 secs Fri Sep  4 10:52
start-stop-daem        root     ??         0.00 secs Fri Sep  4 11:00
start-stop-daem  S     root     ??         0.00 secs Fri Sep  4 11:00
klogd             F    klog     ??         0.00 secs Fri Sep  4 10:52
tput                   root     ??         0.00 secs Fri Sep  4 11:00
tput                   root     ??         0.00 secs Fri Sep  4 11:00
readlink               root     ??         0.00 secs Fri Sep  4 11:00
sysklogd               root     ??         0.00 secs Fri Sep  4 11:00
readlink               root     ??         0.00 secs Fri Sep  4 11:00
syslogd                root     ??         0.00 secs Fri Sep  4 11:00
chown            S     root     ??         0.00 secs Fri Sep  4 11:00
chown            S     root     ??         0.01 secs Fri Sep  4 11:00
chown            S     root     ??         0.00 secs Fri Sep  4 11:00
chown            S     root     ??         0.01 secs Fri Sep  4 11:00
chown            S     root     ??         0.00 secs Fri Sep  4 11:00
chown            S     root     ??         0.00 secs Fri Sep  4 11:00
chown            S     root     ??         0.00 secs Fri Sep  4 11:00
chown            S     root     ??         0.00 secs Fri Sep  4 11:00
chown            S     root     ??         0.00 secs Fri Sep  4 11:00
chown            S     root     ??         0.01 secs Fri Sep  4 11:00
chown            S     root     ??         0.00 secs Fri Sep  4 11:00
chown            S     root     ??         0.00 secs Fri Sep  4 11:00
chown            S     root     ??         0.00 secs Fri Sep  4 11:00
syslogd-listfil        root     ??         0.00 secs Fri Sep  4 11:00
start-stop-daem  S     root     ??         0.00 secs Fri Sep  4 11:00
syslogd          SF    syslog   ??         0.00 secs Fri Sep  4 10:52
cron             SF    root     ??         0.00 secs Fri Sep  4 11:00
tput                   root     ??         0.00 secs Fri Sep  4 11:00
readlink               root     ??         0.00 secs Fri Sep  4 11:00
grep                   root     ??         0.00 secs Fri Sep  4 11:00
sysklogd          F    root     ??         0.00 secs Fri Sep  4 11:00
sh                     root     ??         0.00 secs Fri Sep  4 11:00

last登陆用户没发现异常。。。怎么回事？

Re: 服务器每小时收到一次重启，被黑了？请大家看看！

发表于 ： 2009-09-07 14:30
由 suitq
查看以下netstat 有哪里端口 和 syslog messages文件
ps 进程数看
所有显示的时间为 UTC+08:00
分页： 1 / 1

由 phpBB® Forum Software © phpBB Limited 提供支持

简体中文语言由 phpBB Chinese 制作并提供支持