pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedPerformance problem postgresql 9.5
7+ messages / 6 participants
[nested] [flat]
* Performance problem postgresql 9.5
@ 2018-06-08 19:56 Miguel Angel Sanchez Sandoval <massanche@gmail.com>
0 siblings, 4 replies; 7+ messages in thread
From: Miguel Angel Sanchez Sandoval @ 2018-06-08 19:56 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org; pgsql-general@lists.postgresql.org
Hi guys, migrate from 8.4 to 9.5, all OK except that 2-3 days pass and the
database experiences slowness, I execute the linux top command and it shows
me a postgres user process executing a strange command (2yhdgrfrt63788)
that I consume a lot of CPU, I see the querys active and encounter select
fun ('./ 2yhdgrfrt63788') , this did not happen in version 8.4, any help
would appreciate it.
regards
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Performance problem postgresql 9.5
@ 2018-06-08 20:04 Pavan Teja <pavan.postgresdba@gmail.com>
parent: Miguel Angel Sanchez Sandoval <massanche@gmail.com>
3 siblings, 0 replies; 7+ messages in thread
From: Pavan Teja @ 2018-06-08 20:04 UTC (permalink / raw)
To: Miguel Angel Sanchez Sandoval <massanche@gmail.com>; +Cc: pgsql-admin@lists.postgresql.org; pgsql-general@lists.postgresql.org
Could you please give more briefing about the queries executed.
Let me know whether they are dml or ddl.
Provide information like how long and from what time the queries are in
running state, so that we can find a way to find the exact pain area.
What is the size of the database??
When were the statistics gathered??
Regards,
Pavan
On Sat, Jun 9, 2018, 1:27 AM Miguel Angel Sanchez Sandoval <
massanche@gmail.com> wrote:
>
> Hi guys, migrate from 8.4 to 9.5, all OK except that 2-3 days pass and the
> database experiences slowness, I execute the linux top command and it shows
> me a postgres user process executing a strange command (2yhdgrfrt63788)
> that I consume a lot of CPU, I see the querys active and encounter select
> fun ('./ 2yhdgrfrt63788') , this did not happen in version 8.4, any help
> would appreciate it.
>
> regards
>
>
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Performance problem postgresql 9.5
@ 2018-06-08 20:09 Alvaro Herrera <alvherre@2ndquadrant.com>
parent: Miguel Angel Sanchez Sandoval <massanche@gmail.com>
3 siblings, 2 replies; 7+ messages in thread
From: Alvaro Herrera @ 2018-06-08 20:09 UTC (permalink / raw)
To: Miguel Angel Sanchez Sandoval <massanche@gmail.com>; +Cc: pgsql-admin@lists.postgresql.org; pgsql-general@lists.postgresql.org
On 2018-Jun-08, Miguel Angel Sanchez Sandoval wrote:
> Hi guys, migrate from 8.4 to 9.5, all OK except that 2-3 days pass and the
> database experiences slowness, I execute the linux top command and it shows
> me a postgres user process executing a strange command (2yhdgrfrt63788)
> that I consume a lot of CPU, I see the querys active and encounter select
> fun ('./ 2yhdgrfrt63788') , this did not happen in version 8.4, any help
> would appreciate it.
Hmm, has your database been compromised? You may have an intruder there --
beware.
--
Álvaro Herrera https://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Performance problem postgresql 9.5
@ 2018-06-08 20:26 Steve Atkins <steve@blighty.com>
parent: Alvaro Herrera <alvherre@2ndquadrant.com>
1 sibling, 0 replies; 7+ messages in thread
From: Steve Atkins @ 2018-06-08 20:26 UTC (permalink / raw)
To: pgsql-generallists.postgresql.org <pgsql-general@lists.postgresql.org>; +Cc: Miguel Angel Sanchez Sandoval <massanche@gmail.com>
> On Jun 8, 2018, at 1:09 PM, Alvaro Herrera <alvherre@2ndquadrant.com> wrote:
>
> On 2018-Jun-08, Miguel Angel Sanchez Sandoval wrote:
>
>> Hi guys, migrate from 8.4 to 9.5, all OK except that 2-3 days pass and the
>> database experiences slowness, I execute the linux top command and it shows
>> me a postgres user process executing a strange command (2yhdgrfrt63788)
>> that I consume a lot of CPU, I see the querys active and encounter select
>> fun ('./ 2yhdgrfrt63788') , this did not happen in version 8.4, any help
>> would appreciate it.
>
> Hmm, has your database been compromised? You may have an intruder there --
> beware.
Definitely.
The machine is compromised and doing Bad Things.
Image it if possible; save the compromise payload you know about if not.
Treat it as compromised and unsafe to attach to a network until you completely wipe and reinstall it.
It's probably a compromise via postgresql open to the network with insecure settings. I've seen several of those reported recently, and this one is saving it's payload to the postgresql data directory - somewhere no other user or app will have access to, but which a compromised postgresql can easily write to.
Check the pg_hba.conf and packet filter / firewall settings and see what the issue may be. Do the same checks on all your other postgresql servers, test and production. If there's a configuration mistake that let one server be compromised it's may well be there on others too.
Unless you are positive the server was not attacked, don't trust it unless you can be absolutely certain it is clean. Best bet is to backup any critical data (and check it for trustworthiness), wipe and rebuild.
Cheers,
Steve
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Performance problem postgresql 9.5
@ 2018-06-08 21:06 Chapman Flack <chap@anastigmatix.net>
parent: Miguel Angel Sanchez Sandoval <massanche@gmail.com>
3 siblings, 0 replies; 7+ messages in thread
From: Chapman Flack @ 2018-06-08 21:06 UTC (permalink / raw)
To: Miguel Angel Sanchez Sandoval <massanche@gmail.com>; pgsql-admin@lists.postgresql.org; pgsql-general@lists.postgresql.org
On 06/08/2018 03:56 PM, Miguel Angel Sanchez Sandoval wrote:
> I see the querys active and encounter
> select fun ('./ 2yhdgrfrt63788')
Would it be possible (observing appropriate precautions for
a compromised server) to report here the language and definition
of any function(s) named 'fun' in that database? Effectively:
select lanname, prosrc, probin
from pg_proc join pg_language as l on l.oid = prolang
where proname = 'fun';
Regards,
-Chap
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Performance problem postgresql 9.5
@ 2018-06-09 13:27 Andreas Kretschmer <andreas@a-kretschmer.de>
parent: Alvaro Herrera <alvherre@2ndquadrant.com>
1 sibling, 0 replies; 7+ messages in thread
From: Andreas Kretschmer @ 2018-06-09 13:27 UTC (permalink / raw)
To: pgsql-general@lists.postgresql.org
Am 08.06.2018 um 22:09 schrieb Alvaro Herrera:
> On 2018-Jun-08, Miguel Angel Sanchez Sandoval wrote:
>
>> Hi guys, migrate from 8.4 to 9.5, all OK except that 2-3 days pass and the
>> database experiences slowness, I execute the linux top command and it shows
>> me a postgres user process executing a strange command (2yhdgrfrt63788)
>> that I consume a lot of CPU, I see the querys active and encounter select
>> fun ('./ 2yhdgrfrt63788') , this did not happen in version 8.4, any help
>> would appreciate it.
> Hmm, has your database been compromised? You may have an intruder there --
> beware.
>
https://www.imperva.com/blog/2018/03/deep-dive-database-attacks-scarlett-johanssons-picture-used-for...
Regards, Andreas
--
2ndQuadrant - The PostgreSQL Support Company.
www.2ndQuadrant.com
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Performance problem postgresql 9.5
@ 2018-06-09 17:40 Miguel Angel Sanchez Sandoval <massanche@gmail.com>
parent: Miguel Angel Sanchez Sandoval <massanche@gmail.com>
3 siblings, 0 replies; 7+ messages in thread
From: Miguel Angel Sanchez Sandoval @ 2018-06-09 17:40 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org; pgsql-general@lists.postgresql.org
Guys, indeed I had an intruder, with the recent migration I installed
a remote mirror that had a vulnerability. Thank you very much for your
fast
response.
My best regards
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&...;
Libre
de virus. www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&...;
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
2018-06-08 14:56 GMT-05:00 Miguel Angel Sanchez Sandoval <
massanche@gmail.com>:
>
> Hi guys, migrate from 8.4 to 9.5, all OK except that 2-3 days pass and the
> database experiences slowness, I execute the linux top command and it shows
> me a postgres user process executing a strange command (2yhdgrfrt63788)
> that I consume a lot of CPU, I see the querys active and encounter select
> fun ('./ 2yhdgrfrt63788') , this did not happen in version 8.4, any help
> would appreciate it.
>
> regards
>
>
^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2018-06-09 17:40 UTC | newest]
Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2018-06-08 19:56 Performance problem postgresql 9.5 Miguel Angel Sanchez Sandoval <massanche@gmail.com>
2018-06-08 20:04 ` Pavan Teja <pavan.postgresdba@gmail.com>
2018-06-08 20:09 ` Alvaro Herrera <alvherre@2ndquadrant.com>
2018-06-08 20:26 ` Steve Atkins <steve@blighty.com>
2018-06-09 13:27 ` Andreas Kretschmer <andreas@a-kretschmer.de>
2018-06-08 21:06 ` Chapman Flack <chap@anastigmatix.net>
2018-06-09 17:40 ` Miguel Angel Sanchez Sandoval <massanche@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox