Process PHP send email

Hello,

Read apache logs for the particular domain and check apache server-status page. Your site/server might be under ddos or spam-bot attacks. Or it might be a brute-force attack on WP, Joomla, Drupal sites, etc; or even attack on their vulnerabilities.
 
All is normal, i turn off alert kill process on CSF. Can you give me the skype id?
 
If you've got more questions, please post them here. If you need a private help then please post your request on my website (you can find a link in my signature).
 
Really, i don't know start from where. I checked all log and it normal. Many process still run. What can i do?
 
Last edited:
I'm not sure what is normal for you, so still somebody should check webserver logs and server-status page. Check your homedirs with clamav/maldet. Check netstat output.
 
I check file httpd.conf in /usr/local/directadmin/data/users/admin

Content of httpd.conf

Code: 
# Auto generated apache config file by DirectAdmin version 1.46.3
# Modifying this file is not recommended as any changes you make will be
# overwritten when the user makes any changes to his/her website

# For global config changes that affect all Users, see this guide:
# http://help.directadmin.com/item.php?id=2
# For local config changes that only affect one User, see this guide:
# http://help.directadmin.com/item.php?id=3


<Directory "/home/admin/public_html">
    <IfModule mod_fcgid.c>
        SuexecUserGroup admin admin
    </IfModule>
    <IfModule mod_fcgid.c>
        <FilesMatch "\.php$">
            SetHandler fcgid-script
            FCGIWrapper '/usr/local/safe-bin/fcgid53.sh /usr/local/directadmin/data/users/admin/php/domainabc.com.ini -d open_basedir="/home/admin/:/tmp:/var/tmp:/usr/local/lib/php/:/usr/local/php53/lib/php/" -d mail.log="/home/admin/.php/php-mail.log"' .php
            Options +ExecCGI
        </FilesMatch>
    </IfModule>
</Directory>

<VirtualHost xxx.xxx.xxx.xxx:8080 127.0.0.1:8080 >
    ServerName www.domainabc.com
    ServerAlias www.domainabc.com domainabc.com 
    ServerAdmin [email protected]
    DocumentRoot /home/admin/domains/domainabc.com/public_html
    ScriptAlias /cgi-bin/ /home/admin/domains/domainabc.com/public_html/cgi-bin/
    UseCanonicalName OFF
    <IfModule !mod_ruid2.c>
        SuexecUserGroup admin admin
    </IfModule>
    CustomLog /var/log/httpd/domains/domainabc.com.bytes bytes
    CustomLog /var/log/httpd/domains/domainabc.com.log combined
    ErrorLog /var/log/httpd/domains/domainabc.com.error.log
    <Directory /home/admin/domains/domainabc.com/public_html>
        <IfModule mod_fcgid.c>
            FCGIWrapper '/usr/local/safe-bin/fcgid53.sh /usr/local/directadmin/data/users/admin/php/domainabc.com.ini -d sendmail_from="[email protected]" -d open_basedir="/home/admin/:/tmp:/var/tmp:/usr/local/lib/php/:/usr/local/php53/lib/php/" -d mail.log="/home/admin/.php/php-mail.log"' .php
            <FilesMatch "\.php$">
                SetHandler fcgid-script
                Options +ExecCGI
            </FilesMatch>
        </IfModule>
    </Directory>
    RewriteEngine on
    RewriteOptions inherit
</VirtualHost>

What should i change of config? The process still running :(
 
I don't know what and why you want to change in the virtual host. Those lines you see in top output with all the params including email address do not denote anything wrong. That's how php is executed with mod_fcgid. Number of lines might cause someone to worry... and still somebody should check webserver logs and server-status page.
 
But the process take high load CPU. I'm changing to mod-php. Not sure issues about it.
 
As an addition to what was already suggested (reading webserver logs and checking server-status page), if a php process is long running then it might be an issue between PHP and MySQL communication, or MySQL query takes too much time to complete.
 
You must log in or register to reply here.
Back
Top