Andrew, thanks for the suggestion. The 4am restart is initiated by the logrotate daemon as part of /etc/logrotate.d/apache
Is there an easy way to identify the Adore worm? I run my own file check process on all exectuables, libraries and etc and that hasn't shown up any changes other than the updates (maybe I better have a closer look :-) It would actually appear that mod_ssl has changed - I've given up solving the actual problem - I've bypassed it instead. Until the day I updated mod_ssl there were no problems. Not being the current release and my setup being unusual I'd guess that maybe noone else has spotted what might be a change in the way mod_ssl works (but the RPM changelog shows nothing) My computer had two IP addresses for SSL connections each with a different host name - but I was just using the standard snakeoil certificate. I've removed the 2nd named SSL Virtual Host and put it on another computer (left the default SSL Virtual Host enabled) Now the first computer start up OK every time. (The second computer wasn't already using SSL so it's fine) > Is it the Apache that is restarting or the server itself? > > I've seen worms that restart servers at 4:00 AM > > If it is the server that is restarting, check if it is infected with > the Adore worm. > > This worm can infect servers running old wu-ftpd and rpc.statd. If you > are now ftping to the server, try using sftp instead. It is more secure > and doesn't have the same vulnerability. If you are running rpc.statd, > get the most recent rpm from Redhat and upgrade. > > --- Andrew K Smith <[EMAIL PROTECTED]> wrote: >> Hi, >> I was wondering if anyone else has seen this and/or knows what's >> happening >> ... >> >> My apache web server has started failing every morning at 4am when it >> does a >> SIGHUP with the following error: >> >> Anyone got any suggestion on where to look? > > Andrew Berkowitz -- -Thanks -Andrew MS ... if only he hadn't been hang gliding! _______________________________________________ Seawolf-list mailing list [EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/seawolf-list
