[Plug-security] CPU Alert for host "metasploitable"

[Lisa Kachold]

Looks like someone's "testing"?

This is 12.159.65.86 a public pentesting resource run from DeVry University
rack at OneNeck:

**
   To view this email as a web page, go
here<https://wwws.appfirst.com/alerting/email/9928/4075987/>.

   <https://wwws.appfirst.com>    CPU has been above 75% during the 3
minutes from August 11 19:10 through August 11 19:12 UTC for host
"metasploitable".


View Graph<https://wwws.appfirst.com/correlate/?range=%5B1376244540%2C1376248320%5D&initial=%5B%22c246646%22%5D&version=2&resources=%5B%22server_246646_cpu%22%5D>

Resolve Now <https://wwws.appfirst.com/resolve/?incident=4075987>



During the 3 minutes from August 11 19:10 through August 11 19:12 UTC,
usage of CPU for this host averaged 5.87%.

In the 7 minutes from August 11 19:06 through August 11 19:12 UTC, usage of
CPU for this host increased from 0.72% to 100.32%.


Processes on this host with the greatest increase in usage of CPU during
the 7 minutes from August 11 19:06 through August 11 19:12 UTC:

HostProcessPIDIncreasemetasploitableperl3166699.19% (new process)
metasploitableruby51270.05%metasploitablepickup309270.01%

Processes on this host using the greatest average CPU during the 3 minutes
from August 11 19:10 through August 11 19:12 UTC:

HostProcessPIDUsagemetasploitableperl3166699.33%metasploitablejsvc50820.27%
metasploitablecollector310380.27%metasploitableruby51270.05%metasploitable
fluxbox51590.01%

Processes with statistically unusual resource usage on this server:
(comparing the last 5 minutes from August 11 19:08 through August 11 19:12
UTC to the previous hour beginning August 11 18:08 UTC):

ResourceHostProcessPIDAverage In Hour Before Last 5 MinutesAverage In Last
5 MinutesFile (I/O Read)metasploitablecron50493,265 bytes4,297 bytesCPU
metasploitableruby51270%0.05%CPUmetasploitablecollector310380.31%0.28%
Resources

   - Learn About Our
Products<http://www.appfirst.com/features/problem-resolution/>
   - Help Documentation <http://support.appfirst.com/docs/>
   - Visit our website <http://www.appfirst.com/>

Questions or comments? Please contact us <support at appfirst.com>. We love to
hear from our customers!

[image: Follow AppFirst on
Facebook]<http://www.facebook.com/pages/AppFirst/350056598034>

[image: Follow AppFirst on Twitter] <http://www.twitter.com/appfirst>

Join our IRC <http://support.appfirst.com/irc/> for help in real-time!

[image: Read AppFirst's Blog] <http://appfirst.com/blog>

  If you do not wish to receive these alert emails from AppFirst, manage
your alert email settings <https://wwws.appfirst.com/manage/profile/> to
turn the alert off, or unsubscribe from it. Learn more about our privacy
policy <http://www.appfirst.com/legal/privacy/>.



-- 

(503) 754-4452 Android
(623) 239-3392 Skype
(623) 688-3392 Google Voice
**
it-clowns.com <http://it-clowns.com/c/>
Chief Clown
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.phxlinux.org/pipermail/plug-security/attachments/20130811/bf3154be/attachment.html>