Is this DDoS attack?

1) use iptables to turn off access to ssh from everywhere, then only allow known save IP addresses.

2) please use the code tags or post your output to http://pastebin.ca, this will avoid the mess that's above.

3) use "top" to find the top gluttons of CPU and memory. Use the "m" and "c" keys to switch back and forth. Report your findings.

If you need more detail, just ask.

Yes, that's why I said that you are going to have to use it to find the top resource hogs. You didn't state any of your findings. Top uses terminal escape codes to move the cursor around, so if you want a screen shot of it you're going to have to take a screen shot in the graphical sense. Or you can just tell us what seems to be using the most CPU and RAM. The top four or five contenders should be enough, as long as you give your impressions of order.

Also, if I'm understanding your second post correctly, you're using this as a firewall too? Bad idea. I think you may have just found out one of the reasons why.

Considering the ps you ran was basically at a random time, and it caught sendmail in the act of sending mail, that strikes me as kind of weird for a phone system. Unless you've set it up to be a mail server too (which you shouldn't do either) or this system takes a lot of voicemail, that probably shouldn't have happened. My gut feeling is that your box has been hijacked and it's now being used as a spam relay or sender. But that's my guess. A tail -f of /var/log/maillog should confirm this pretty quick.

I think you need to tell us a whole lot more about how this system is set up.

Oh, and do ps auxgwww and paste that output, it will show everything.

OK, sendmail is going crazy and it looks like munin is the culprit. I'm guessing from the information available to me that munin is going (and this is a technical term) "ape shit" and sending lots of messages through sendmail.

Stop munin from running to see if that fixes the problem:

service munin-node stop

If that is then you can dig a bit further to find out why. You probably have a lot of queued up mail, so you may want to clean it out.

You can do this pretty easily with mutt, but you'll have to install it:

yum install mutt

Then launch mutt and use the on-screen help for more information. You can delete messages by regex, so it'll make it easy to delete a lot of similar messages at once.

If you have more questions, go ahead and ask.

I rebooted and stopped the munin-node (also done chkconfig munin-node off), yet after two minutes the entire resources are consumed by unknown processes :( (the munin is something that I never used, so do not know whether that is accessible or not, I have a default installation of TB).

I would suspect that there's some other underlying issue. You might want to keep digging.

You can just uninstall the munin stuff. Do:

rpm -qa | grep munin

and for each munin related package do:

rpm -e packagename

As for mutt:

once in mutt, type "?" and you'll get a help list. You'll see that one of the options is D for "delete messages matching a pattern". So, if you want to get rid of anything with "trixbox" in the subject, you would press "D" and then you'll get a message at the bottom that says "Delete messages matching:" and it will wait for input. Type in your pattern there and hit enter.

It's possible there's still a cron job trying to run.

If the file:

/etc/cron.d/munin

exists, delete it (or move it to somewhere else.)

However, your mail spool may be full too. Before starting sendmail, check /var/spool/mqueue and if there are any queue files and data files you might want to delete them out (beware of collateral damage such as emailed voicemail messages and such.)

bump!!