Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


To Providers: What processes and netstat results do you search for to detect abuse? - Page 2
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

To Providers: What processes and netstat results do you search for to detect abuse?

2»

Comments

  • Kill windows and 90% issues are over :P

  • jarjar Patron Provider, Top Host, Veteran

    @Damian said: Said the non-provider :P

    You mean the guy who built our first node ;)

    @serverian To be honest I use top, iftop, and iptraf. I have munin text me when anything gets out of control.

  • @jarland, the reason I asked this to write a abuse detector designed for KVM since it's not easy to do it as in OpenVZ. After seeing responses, I decided not to make it open source, though.

  • seriesnseriesn Member
    edited April 2013

    @severian what if give you a full pie and you hand over the source code. Sounds like a good deal. Jarland will only give you half.

    But seriously, if you can do one for KVM, I am willing to pm you a copy of our Abuse detector script.

  • @seriesn said: But seriously, if you can do one for KVM, I am willing to pm you a copy of our Abuse detector script.

    I've already coded the most hard part.

  • Well, the script only has list of files we use for our detection.

  • As far as I know, the only way to 'enforce' this is some sort of a daemon/module running inside the VM itself.

    This is how DigitalOcean does it (You need their kernel module for snapshotting and associated features to work), and this probably would have to follow the same philosophy.

  • @Zen said: Throw me a PM and let me know how you are manipulating the processes and files in real time?

    It's not real time unfortunately. However, it's very efficient and I'm not installing anything on the VMs.

Sign In or Register to comment.