This question already has an answer here:
- How do I deal with a compromised server? 13 answers
First of all, a disclamer, I am not a sys admin, I was just asked to check why a VM of ours is using a lot of the cpu.
It turns out that this process is running for ever on 200%
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
11058 www-data 20 0 269564 5812 384 S 185.5 0.1 2:42.95 .resyslogd
After some research I figured out that this is a logger (actually I found that the logger is the rsyslog but i gess resyslog is the same thing.
So i noticed that there are alot of connection attempts (from bots I am guessing) that was triggering the logger to write. So I decided to stop allowing passwords for loging in and switched to key authentication. That did nothing for the cpu usage, even though the records on the logger where now less than before. for the random IPs that i was seeing on the logger, I added them on /etc/hosts.deny.
After all these the cpu usage has not droped at all. the same process is using more than 100% of the cpu core.
I know that the www-data is a web server, assuming apache, and dont know if it actually used for any reason.
Any help is highly appreciated.