uid 80: exited on signal 6

[CyberLeo Kitsana]

Zbigniew Szalbot wrote:
> szalbot.homedns.org kernel log messages: +++ /tmp/security.BfIqepKO Fri Oct
> 12 03:08:35 2007 
> +pid 82543 (httpd), uid 80: exited on signal 6 
> +pid 82542 (httpd), uid 80: exited on signal 6 
> +pid 82541 (httpd), uid 80: exited on signal 6 
> +pid 82537 (httpd), uid 80: exited on signal 6 
> +pid 82533 (httpd), uid 80: exited on signal 6 
> +pid 82536 (httpd), uid 80: exited on signal 6 
> +pid 82535 (httpd), uid 80: exited on signal 6 
> +pid 82534 (httpd), uid 80: exited on signal 6 
> +pid 3653 (httpd), uid 80: exited on signal 6

This means that the httpd child processes are crashing, most likely in
response to a request. Because apache creates child processes
dynamically to handle load (at least, with the default MPM) these
crashed processes are automatically replaced, and the server continues
happily servicing requests.

It might be a good idea to go through your access and error logs and see
if there are any suspicious-looking or unusually long requests that
might be trying to exploit a buffer overflow vulnerability in apache or
a module thereof.

If you are using mod_php, though, it's more likely that it's a bug in
PHP or a PHP extension that's being flushed out by some rarely used
script on your server.

-- 
Fuzzy love,
-CyberLeo
Technical Administrator
CyberLeo.Net Webhosting
http://www.CyberLeo.Net
<CyberLeo at CyberLeo.Net>

Furry Peace! - http://wwww.fur.com/peace/