0

i have a simple VPS running with Ubuntu 12.04.

The following Software is installed: - Apache - MySQL - PHP - Elasticsearch - A symfony Project - wkhtml2pdf

The Symfony Project uses the local Elasticsearch instance. HTOP Command Output PLESK PowerPanel System Ressources

As you can see these are Processes that use nearly my full CPU-Power.

The Processes are always starting at nearly the same time at night (4AM, Middle European Time).

What is this? Ich checked the SSH Access Logs - there are some attempts to break in but no one succeeded as far as i can see.

Thanks in advance!

3
  • did you manage to find the origin of your issue? Cause the selected answer is not really helping and I encounter something that looks like your problem right now with a, until now unexplained, burst at 4AM Dec 18, 2015 at 9:40
  • Hey Martin, the Problem is a Security Issue in the Elasticsearch Software. If you experience the Same Problem as me someone hacked you! What to do? 1. Update Elasticsearch 2. Block direct ES Access by Remote Systems How to Disable ES Access by Remote Systems? 1. open /etc/elasticsearch/elasticsearch.yml 2. set network.host: localhost => Done! Dec 21, 2015 at 11:33
  • Thanks for your answer Florian. I'll take a look at it. How can you ensure that it is someone who hacked you? Cause in my case, it's very unlikely cause the ES is supposedly in a network not accessible from outside. Did you had any suspicious log, which type of entry? Dec 21, 2015 at 12:50

1 Answer 1

0

Change the port number for elasticsearch.
Creating a redirect URL(apache2) to elasticsearch.
block ES to be accessed by remote system(directly)
This might help
I also faced this and i did exactly the same

1
  • Can you give me some details on how to do that? Sep 29, 2014 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.