Solr runs automatically and hangs the system

[Sunil Kumar Saini]

Hi,

We have Confluence 6.9.1 installed in our server, it's been running fine from last few years.

Suddenly we started observing system hangs and loads keep going high.

issue is caused by this solrd.

is this called by lucene for indexing ? its starting from /tmp directory. how can we stop it, it keeps coming again and again.

Thanks,

Sunil Saini

[Mohit Dhir]

upgrade to 7.4. latest or 7.13.0 

[Эрдем Болданов]

updated to the latest version. thanks, helped

[Nic Brough -Adaptavist-]

It's nothing to do with Confluence.  Confluence doesn't use solr natively.

Someone has set solr up to run as the confluence user.

[Эрдем Болданов]

same problem. is it a confluence vulnerability? version 7.2.0

[Daniel Ebers]

Please check why 'solr' is hiding in a directory (/tmp/.solr) - the dot means directory is hidden when listing, for example using 'ls' without further parameters.

Or in other words: please make sure if there is no malicious activity on the server - while this is Atlassian community and we're mainly dealing with Atlassian products I just wanted to mention from your picture the system looks not healty. Just make sure it is not hacked.

[Trần Minh Sơn]

Dear all,

I also suffered from this solrd process created / runned by confluence1 user. Is it a bug or a hack ? How can I disable this process please?

Many thanks

[Martin Faust]

It is a monero mining malware installed through your confluence instance. Check your crontab of the confluence user...

[Christoph Mussenbrock]

Very helpful. Do you have any idea how this could happen? Is there a vulnerability in confluence?

[Nic Brough -Adaptavist-]

Yes (my earlier post was made before I was aware of it).  See https://community.atlassian.com/t5/Confluence-articles/Security-Advisory-for-Confluence-Server-and-Data-Center-August/ba-p/1787026