Well it happened again so I did a lsof. This is pretty weird. The exim
process has both apache and exim files open.
[root@student bin]# netstat -nap --inet |grep -w 80|grep LISTEN
tcp 0 0 0.0.0.0:80 0.0.0.0:*
LISTEN 6594/exim
[root@student bin]# lsof -p 6594
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
exim 6594 root cwd DIR 8,5 216 34246 /var/spool/exim
exim 6594 root rtd DIR 8,5 616 2 /
exim 6594 root txt REG 8,5 592421 460036
/usr/local/exim/bin/exim-4.12-1
exim 6594 root mem REG 8,5 82033 2396
/lib/ld-2.3.2.so
exim 6594 root mem REG 8,5 69443 2448
/lib/libresolv-2.3.2.so
exim 6594 root mem REG 8,5 83736 2420
/lib/libnsl-2.3.2.so
exim 6594 root mem REG 8,5 23248 2414
/lib/libcrypt-2.3.2.so
exim 6594 root mem REG 8,5 760175 2667
/lib/libdb-4.0.so
exim 6594 root mem REG 8,5 163783 340315
/usr/local/mysql/lib/mysql/libmysqlclient.so.10.0.0
exim 6594 root mem REG 8,5 224721 492419
/lib/libssl.so.0.9.6b
exim 6594 root mem REG 8,5 995632 377048
/lib/libcrypto.so.0.9.6b
exim 6594 root mem REG 8,5 1376438 2412
/lib/libc-2.3.2.so
exim 6594 root mem REG 8,5 60805 9386
/usr/lib/libz.so.1.1.4
exim 6594 root mem REG 8,5 166659 2418
/lib/libm-2.3.2.so
exim 6594 root mem REG 8,5 12165 2416
/lib/libdl-2.3.2.so
exim 6594 root mem REG 8,5 47504 2436
/lib/libnss_files-2.3.2.so
exim 6594 root 0u CHR 1,3 20423 /dev/null
exim 6594 root 1u CHR 1,3 20423 /dev/null
exim 6594 root 2u CHR 1,3 20423 /dev/null
exim 6594 root 3u IPv4 204330701 TCP *:http (LISTEN)
exim 6594 root 4w REG 8,5 12 101395
/usr/local/apache2/logs/access_log
exim 6594 root 5w REG 8,5 232965632 381681
/usr/local/apache2/logs/student2.ednet.ns.ca_access.log
exim 6594 root 6w REG 8,5 167414 170036
/usr/local/apache2/logs/mrtg.ednet.ns.ca_access.log
exim 6594 root 7w REG 8,5 3601181 386291
/usr/local/apache2/logs/roaming-imp.ednet.ns.ca_access.log
exim 6594 root 8w REG 8,5 5948169 336373
/usr/local/apache2/logs/scolaire2.ednet.ns.ca_access.log
exim 6594 root 9w REG 8,5 232965632 381681
/usr/local/apache2/logs/student2.ednet.ns.ca_access.log
exim 6594 root 10w REG 8,5 288325897 200709
/usr/local/apache2/logs/staff2.ednet.ns.ca_access.log
exim 6594 root 11r FIFO 0,5 204330715 pipe
exim 6594 root 12w FIFO 0,5 204330715 pipe
exim 6594 root 13u REG 8,5 66699411 201006
/usr/local/apache2/logs/error_log
exim 6594 root 14u REG 8,5 444948 383725
/usr/local/apache2/logs/student2.ednet.ns.ca_error.log
exim 6594 root 15u REG 8,5 63047 307433
/usr/local/apache2/logs/mrtg.ednet.ns.ca_error.log
exim 6594 root 16u REG 8,5 3926 312314
/usr/local/apache2/logs/roaming-imp.ednet.ns.ca_error.log
exim 6594 root 17u REG 8,5 9762 383460
/usr/local/apache2/logs/scolaire2.ednet.ns.ca_error.log
exim 6594 root 18u REG 8,5 922836 202914
/usr/local/apache2/logs/staff2.ednet.ns.ca_error.log
exim 6594 root 19uw REG 8,5 2088 569481
/var/spool/exim/input/1968Dk-0001iK-00-D
exim 6594 root 20u sock 0,0 204374818 can't
identify protocol
exim 6594 root 21r REG 8,5 45253 536256
/usr/local/apache2/htdocs-student/horde/imp/compose.php
exim 6594 root 22w REG 8,5 0 569832
/var/spool/exim/msglog/1968Dk-0001iK-00
exim 6594 root 23u IPv4 204375951 TCP
localhost:46742->localhost:imap (CLOSE_WAIT)
exim 6594 root 24u unix 0xe7dc9700 204350607 socket
exim 6594 root 25w REG 8,5 0 571491
/var/spool/exim/input/1968Dk-0001iK-00-J
exim 6594 root 26r FIFO 0,5 204375989 pipe
Hirling Endre wrote:
> On Mon, 2003-04-07 at 18:31, Patrick Boutilier wrote:
>
>>[root@student root]# netstat -nap --inet |grep 80 |grep LISTEN
>>tcp 0 0 0.0.0.0:80 0.0.0.0:*
>>LISTEN 24378/exim
>
>
> You should have done an 'lsof -p 24378' to see whether it's really your
> installed exim binary or just something that calls itself exim but
> listens on port 80 and does other, perhaps even nasty things.
>
> -m-
>
>
> --
>
> ## List details at http://www.exim.org/mailman/listinfo/exim-users Exim details at http://www.exim.org/ ##
>
