pg.ddx.io pgsql-performance@postgresql.org mailing list archive
help / color / mirror / Atom feedCPU 100% usage caused by unknown postgres process..
4+ messages / 4 participants
[nested] [flat]
* CPU 100% usage caused by unknown postgres process..
@ 2017-12-13 10:12 Dinesh Chandra 12108 <Dinesh.Chandra@cyient.com>
2017-12-13 10:36 ` Re: CPU 100% usage caused by unknown postgres process.. Laurenz Albe <laurenz.albe@cybertec.at>
0 siblings, 1 reply; 4+ messages in thread
From: Dinesh Chandra 12108 @ 2017-12-13 10:12 UTC (permalink / raw)
To: pgsql-performance
Hi,
My CPU utilization is going to 100% in PostgreSQL because of one unknown process /x3303400001 is running from postgres user.
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
19885 postgres 20 0 192684 3916 1420 S 99.3 0.1 5689:04 x3303400001
The same file is automatically created in Postgres Cluster also. I am using Postgresql-9.3.
Kindly suggest how can I resolve this issue.
Regar
Dinesh Chandra
|Database administrator (Oracle/PostgreSQL)| Cyient Ltd. Noida.
------------------------------------------------------------------
Mobile: +91-9953975849 | Ext 1078 |dinesh.chandra@cyient.com<mailto:%7Cdinesh.chandra@cyient.com>
Plot No. 7, NSEZ, Phase-II ,Noida-Dadri Road, Noida - 201 305,India.
________________________________
DISCLAIMER:
This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. Check all attachments for viruses before opening them. All views or opinions presented in this e-mail are those of the author and may not reflect the opinion of Cyient or those of our affiliates.
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: CPU 100% usage caused by unknown postgres process..
2017-12-13 10:12 CPU 100% usage caused by unknown postgres process.. Dinesh Chandra 12108 <Dinesh.Chandra@cyient.com>
@ 2017-12-13 10:36 ` Laurenz Albe <laurenz.albe@cybertec.at>
2017-12-13 12:19 ` Re: CPU 100% usage caused by unknown postgres process.. Justin Pryzby <pryzby@telsasoft.com>
0 siblings, 1 reply; 4+ messages in thread
From: Laurenz Albe @ 2017-12-13 10:36 UTC (permalink / raw)
To: Dinesh Chandra 12108 <Dinesh.Chandra@cyient.com>; pgsql-performance
Dinesh Chandra 12108 wrote:
> My CPU utilization is going to 100% in PostgreSQL because of one unknown process /x3303400001 is running from postgres user.
>
> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
> 19885 postgres 20 0 192684 3916 1420 S 99.3 0.1 5689:04 x3303400001
>
> The same file is automatically created in Postgres Cluster also. I am using Postgresql-9.3.
>
> Kindly suggest how can I resolve this issue.
I don't know, but the same problem has been reported on Stackoverflow:
https://stackoverflow.com/q/46617329/6464308
If your queries look similar, then you might indeed be the victim of an attack.
Figure out where the function and the executable come from.
In case of doubt, disconnect the server from the network.
Yours,
Laurenz Albe
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: CPU 100% usage caused by unknown postgres process..
2017-12-13 10:12 CPU 100% usage caused by unknown postgres process.. Dinesh Chandra 12108 <Dinesh.Chandra@cyient.com>
2017-12-13 10:36 ` Re: CPU 100% usage caused by unknown postgres process.. Laurenz Albe <laurenz.albe@cybertec.at>
@ 2017-12-13 12:19 ` Justin Pryzby <pryzby@telsasoft.com>
2017-12-13 15:22 ` Re: CPU 100% usage caused by unknown postgres process.. Tomas Vondra <tomas.vondra@2ndquadrant.com>
0 siblings, 1 reply; 4+ messages in thread
From: Justin Pryzby @ 2017-12-13 12:19 UTC (permalink / raw)
To: Laurenz Albe <laurenz.albe@cybertec.at>; +Cc: Dinesh Chandra 12108 <Dinesh.Chandra@cyient.com>; pgsql-performance
On Wed, Dec 13, 2017 at 11:36:11AM +0100, Laurenz Albe wrote:
> Dinesh Chandra 12108 wrote:
> > My CPU utilization is going to 100% in PostgreSQL because of one unknown process /x3303400001 is running from postgres user.
> >
> > PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
> > 19885 postgres 20 0 192684 3916 1420 S 99.3 0.1 5689:04 x3303400001
> >
> > The same file is automatically created in Postgres Cluster also. I am using Postgresql-9.3.
> >
> > Kindly suggest how can I resolve this issue.
>
> I don't know, but the same problem has been reported on Stackoverflow:
> https://stackoverflow.com/q/46617329/6464308
>
> If your queries look similar, then you might indeed be the victim of an attack.
>
> Figure out where the function and the executable come from.
>
> In case of doubt, disconnect the server from the network.
Looks suspicious; I would look at (and save) things like these:
ls -l /proc/19885/exe
ls -l /proc/19885/fd
ls -l /proc/19885/cwd
sudo lsof -n -p 19885
sudo netstat -anpe |grep 19885
Stacktrace with gcore/gdb is a good idea.
Save a copy of your log/postgres logfiles and try to figure out where it came
from. Since an attacker seems to control the postgres process, your data may
have been compromized (leaked or tampered with).
Justin
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: CPU 100% usage caused by unknown postgres process..
2017-12-13 10:12 CPU 100% usage caused by unknown postgres process.. Dinesh Chandra 12108 <Dinesh.Chandra@cyient.com>
2017-12-13 10:36 ` Re: CPU 100% usage caused by unknown postgres process.. Laurenz Albe <laurenz.albe@cybertec.at>
2017-12-13 12:19 ` Re: CPU 100% usage caused by unknown postgres process.. Justin Pryzby <pryzby@telsasoft.com>
@ 2017-12-13 15:22 ` Tomas Vondra <tomas.vondra@2ndquadrant.com>
0 siblings, 0 replies; 4+ messages in thread
From: Tomas Vondra @ 2017-12-13 15:22 UTC (permalink / raw)
To: Justin Pryzby <pryzby@telsasoft.com>; Laurenz Albe <laurenz.albe@cybertec.at>; +Cc: Dinesh Chandra 12108 <Dinesh.Chandra@cyient.com>; pgsql-performance
On 12/13/2017 01:19 PM, Justin Pryzby wrote:
> On Wed, Dec 13, 2017 at 11:36:11AM +0100, Laurenz Albe wrote:
>> Dinesh Chandra 12108 wrote:
>>> My CPU utilization is going to 100% in PostgreSQL because of one unknown process /x3303400001 is running from postgres user.
>>>
>>> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
>>> 19885 postgres 20 0 192684 3916 1420 S 99.3 0.1 5689:04 x3303400001
>>>
>>> The same file is automatically created in Postgres Cluster also. I am using Postgresql-9.3.
>>>
>>> Kindly suggest how can I resolve this issue.
>>
>> I don't know, but the same problem has been reported on Stackoverflow:
>> https://stackoverflow.com/q/46617329/6464308
>>
>> If your queries look similar, then you might indeed be the victim of an attack.
>>
>> Figure out where the function and the executable come from.
>>
>> In case of doubt, disconnect the server from the network.
>
> Looks suspicious; I would look at (and save) things like these:
>
> ls -l /proc/19885/exe
> ls -l /proc/19885/fd
> ls -l /proc/19885/cwd
>
> sudo lsof -n -p 19885
> sudo netstat -anpe |grep 19885
>
> Stacktrace with gcore/gdb is a good idea.
> Save a copy of your log/postgres logfiles and try to figure out where it came
> from. Since an attacker seems to control the postgres process, your data may
> have been compromized (leaked or tampered with).
>
Any details about the x3303400001 file (is it a shell script or some
kind of binary)?
FWIW the queries (listed in the stackoverflow post) are running under
postgres, which I assume is superuser. The backend has full access to
the data directory, of course, so it may create extra files (using
adminpack extension, for example).
If that's the case (and if it's indeed an attack), it either means the
attacker likely already has access to all the data. So presumably
x3303400001 is doing something else at the OS level.
regards
--
Tomas Vondra http://www.2ndQuadrant.com
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2017-12-13 15:22 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2017-12-13 10:12 CPU 100% usage caused by unknown postgres process.. Dinesh Chandra 12108 <Dinesh.Chandra@cyient.com>
2017-12-13 10:36 ` Laurenz Albe <laurenz.albe@cybertec.at>
2017-12-13 12:19 ` Justin Pryzby <pryzby@telsasoft.com>
2017-12-13 15:22 ` Tomas Vondra <tomas.vondra@2ndquadrant.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox