Today morning I had powered on one of my machines after 2 months and apache was not running as daemon after digging here and there I found in /etc/init.d/ following files
-rwxr-xr-x 1 root root 0 2011-03-04 06:39 apache2
-rwxr-xr-x 1 root root 0 2011-02-03 06:40 apache2.1
-rwxr-xr-x 1 root root 6157 2010-04-14 01:50 apache2.2
I would like to mention I had not created these apache files in /etc/init.d/ which you see as apache2.1 and apache2.2
after wasting some times to start apache I found only
/etc/init.d/apache2.2 start
is starting the apache2 daemon where as if I use
/etc/init.d/apache start then this will not work.
Then I see following in ps output
ps -el | grep apache2
1 S 0 2466 1 0 80 0 - 32139 poll_s ? 00:00:00 apache2
5 S 33 2617 2466 0 80 0 - 32268 inet_c ? 00:00:00 apache2
5 S 33 2625 2466 0 80 0 - 32310 inet_c ? 00:00:00 apache2
5 S 33 4211 2466 0 80 0 - 32271 inet_c ? 00:00:00 apache2
5 S 33 9072 2466 0 80 0 - 32179 inet_c ? 00:00:00 apache2
5 S 33 9079 2466 0 80 0 - 32177 inet_c ? 00:00:00 apache2
5 S 33 9080 2466 0 80 0 - 32177 inet_c ? 00:00:00 apache2
5 S 33 9081 2466 0 80 0 - 32179 inet_c ? 00:00:00 apache2
5 S 33 9082 2466 0 80 0 - 32177 inet_c ? 00:00:00 apache2
5 S 33 9083 2466 0 80 0 - 32179 inet_c ? 00:00:00 apache2
5 S 33 9084 2466 0 80 0 - 32177 poll_s ? 00:00:00 apache2
where as in /etc/passwd file I see
www-data:x:33:33:www-data:/var/www:/bin/sh
so remaining processes have 33 uid and pid which is corresponding to www-data but the first one in above output is having uid 0 if you notice
So is apache running correctly on this machine if I were to ask or I should further investigate in my server and does it appears compromised? The files apache2.1 and apache2 are blank and only apache2.2 is having required functions for init etc.