Facebook
TwitterWe are running plesk 9.3.0 and every once in a while we are having to shutdown httpd because of a tremendous amount of outbound traffic. The Traffic is to the point where it is slowing down our whole infrastructure.
When it starts happening it overloads our Firebox x1250e. The Firewall shows no traffic but the load is full.
The traffic monitor on the router stops at this point or slows to a crawl. If we unplug the server or stop httpd the overload stops immediately.
It is very intermittent. We suspect it is a virus on one of the hosted sites that is triggered by visiting the infected site. Doing some research we feel it is "gootkit" or some variant "auto-rooter"
The problem is we cannot find which site this is on or coming from.
A little background, This particular setup is running Expand. 2 web servers, 1 mail server and one Expand server.
For now we are running netstat and watching (tail) the access_log files.
any info would be helpful.
When it starts happening it overloads our Firebox x1250e. The Firewall shows no traffic but the load is full.
The traffic monitor on the router stops at this point or slows to a crawl. If we unplug the server or stop httpd the overload stops immediately.
It is very intermittent. We suspect it is a virus on one of the hosted sites that is triggered by visiting the infected site. Doing some research we feel it is "gootkit" or some variant "auto-rooter"
The problem is we cannot find which site this is on or coming from.
A little background, This particular setup is running Expand. 2 web servers, 1 mail server and one Expand server.
For now we are running netstat and watching (tail) the access_log files.
any info would be helpful.
