RE: How do I find what web scripts are calling PERL.EXE?

2004-11-16 Thread Peter Guzis
As a starter, I would suggest auditing how long your HTTP requests are taking.  
The following instructions assume you are running IIS 5.

1. Open Internet Information Services MMC snap-in
2. Right-click particular web site in which you are interested
3. Click "Properties"
4. On the "Web Site" tab, click "Properties" next to "Enable Logging"
5. Make a note of the value next to "Log file name".  You are interested in the 
path formatted like W3SVC#.
6. Select the "Extended Properties" tab
7. Check "Time Taken (time-taken)"
8. Click "OK" twice

Sit back and let the logs accumulate for a few hours to days.  Note: IIS 
buffers writes to log files so, depending on your traffic, it could take a 
while for new results to show up.

When you have enough data, look over the logs (in 
%WinDir%\System32\LogFiles\[directory from step 5]) and make sure any requests 
to a .pl, .cgi, or appropriate Perl-related script extension are not taking an 
inordinate amount of time.  If you start seeing requests take more than a few 
seconds, it's time to investigate the source code for bottlenecks and/or poor 
design.

If, after all this, you're still experiencing issues you might want associate 
Perl scripts to PerlIS.dll for improved start-up times.  Be careful with any 
non-thread safe modules, though.

As a last resort you may want to either upgrade your web server(s) or add more. 
 What are the specs on your web servers and how many do you have?

How much memory are the perl.exe processes using?  Are you running out of 
physical memory perhaps?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of
[EMAIL PROTECTED]
Sent: Tuesday, November 16, 2004 2:38 PM
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED];
[EMAIL PROTECTED]
Subject: How do I find what web scripts are calling PERL.EXE?



Sorry to spam this out to the ActiveState, Web, and Admin groups, but I
wasn't sure exactly where a question like this would go.

I am in the position of hosting a number of sites for which,
unfortunately, I do not have total control.  Nor can I shut the system
down whenever I like.

SOMETHING (I don't know what) is calling the perl.exe process, which is
running under the IUSR_MACHINE account.  It's using up an inordinate
amount of CPU time.  I can't figure out what is doing it.  I can't even
run stats on my http logfiles because they seem to be slowing down. And we
have a lot of Perl files.

Windows 2000 Task Manager is of no help, aside from letting me see that
IUSR_MACHINE is using the 5.8 perl.exe file.  I can't tell what path it is
to be absolutely sure, but it seems likely that this is a web script
someone has loaded that has gone amok, although other possibilities exist,
such as some trojan that is using my server as a DDoS box.

Numerous copies of PERL.EXE are being called, but occasionally drop down
to just one or two copies, and trying to kill them off in Task Manager
doesn't work, either.

Any ideas on how to make PERL.EXE yield up what is calling it?  Using NTFS
auditing would not help, since it would just tell me that IUSR_MACHINE is
doing it.  I could conceivably shut down one site at a time, but that
presents its own problems with good service.

I'd be grateful for any help.

Thanks,

Ian

___
Perl-Win32-Web mailing list
[EMAIL PROTECTED]
To unsubscribe: http://listserv.ActiveState.com/mailman/mysubs

___
Perl-Win32-Web mailing list
[EMAIL PROTECTED]
To unsubscribe: http://listserv.ActiveState.com/mailman/mysubs


How do I find what web scripts are calling PERL.EXE?

2004-11-16 Thread ianm

Sorry to spam this out to the ActiveState, Web, and Admin groups, but I
wasn't sure exactly where a question like this would go.

I am in the position of hosting a number of sites for which,
unfortunately, I do not have total control.  Nor can I shut the system
down whenever I like.

SOMETHING (I don't know what) is calling the perl.exe process, which is
running under the IUSR_MACHINE account.  It's using up an inordinate
amount of CPU time.  I can't figure out what is doing it.  I can't even
run stats on my http logfiles because they seem to be slowing down. And we
have a lot of Perl files.

Windows 2000 Task Manager is of no help, aside from letting me see that
IUSR_MACHINE is using the 5.8 perl.exe file.  I can't tell what path it is
to be absolutely sure, but it seems likely that this is a web script
someone has loaded that has gone amok, although other possibilities exist,
such as some trojan that is using my server as a DDoS box.

Numerous copies of PERL.EXE are being called, but occasionally drop down
to just one or two copies, and trying to kill them off in Task Manager
doesn't work, either.

Any ideas on how to make PERL.EXE yield up what is calling it?  Using NTFS
auditing would not help, since it would just tell me that IUSR_MACHINE is
doing it.  I could conceivably shut down one site at a time, but that
presents its own problems with good service.

I'd be grateful for any help.

Thanks,

Ian

___
Perl-Win32-Web mailing list
[EMAIL PROTECTED]
To unsubscribe: http://listserv.ActiveState.com/mailman/mysubs