[ale] Memory leak (hacked?)
David Corbin
dcorbin at machturtle.com
Sun Apr 11 19:04:25 EDT 2004
On Friday 09 April 2004 10:35, Dow Hurst wrote:
> My wife's box has those in the logs sporadically. Every distro of SuSE
> I've tried so far still generates those. I believe it is the motherboard
> hardware and the ethernet module that generates them. Cheap hardware most
OK, now I know this is wierd, but here is what I've figured out.
1) I can boot from a live-CD and it doesn't leak
2) I built a new kernel on another machine, without module support, and it
does leak.
3) If I remove /var/run/utmp, unmount /var, mount /var, the leak stops.
Yes, I know #3 is very wierd. Any more suggestions?
David
> likely. It isn't sign of being hacked. Under heavy load it increases.
>
> Now if you've got a hidden module inserted by a cracker then you may not
> know what is going on and the heavier load of whatever he/she is serving
> could increase the messages or start them. So it could show your hacked.
>
> Just wanted to let you know that the message happens on other machines.
> Dow
>
> David Corbin wrote:
> > On Wednesday 07 April 2004 07:40, Geoffrey wrote:
> >>David Corbin wrote:
> >>>I have had my public server develop a sudden memory leak. (Honest -
> >>>it is sudden - I've done nothing to that system recently). I keep
> >>>ending up with the following kernel message: __alloc_pages: 0-order
> >>>allocation failed (gfp=0xf0/0) repeatedly.
> >>>
> >>>When I reboot this morning, I watch top, and sure enough, you could
> >>>see the memory steadily creeping upwards. This happens even when I
> >>>boot into single user mode, and have ridiculously free processes:
> >>
> >>Tried running top to see what is eating up your memory? After starting
> >>top enter 'M' (that's uppercase m) and it will sort by memory usage.
> >>You should be able to identify the memory hog.
> >
> > Yes, I did, but I don't see anything growing in an individual process.
> > Only the total memory uses is growing.
> >
> > I have noticed some "Spurious 8259A Interrupt IRQ 7" messages showing up
> > on the console.
More information about the Ale
mailing list