Solr runs automatically and hangs the system

Sunil Kumar Saini February 11, 2021

Hi,

 

We have Confluence 6.9.1 installed in our server, it's been running fine from last few years.

Suddenly we started observing system hangs and loads keep going high.

issue is caused by this solrd.

Screenshot 2021-02-12 at 6.25.51 AM.png

 

is this called by lucene for indexing ? its starting from /tmp directory. how can we stop it, it keeps coming again and again.

 

Thanks,

Sunil Saini

4 answers

1 vote
Mohit Dhir September 6, 2021

upgrade to 7.4. latest or 7.13.0 

Эрдем Болданов September 8, 2021

updated to the latest version. thanks, helped

1 vote
Nic Brough -Adaptavist-
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
February 12, 2021

It's nothing to do with Confluence.  Confluence doesn't use solr natively.

Someone has set solr up to run as the confluence user.

0 votes
Эрдем Болданов September 6, 2021

same problem. is it a confluence vulnerability? version 7.2.0

0 votes
Daniel Ebers
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
February 13, 2021

Please check why 'solr' is hiding in a directory (/tmp/.solr) - the dot means directory is hidden when listing, for example using 'ls' without further parameters.

Or in other words: please make sure if there is no malicious activity on the server - while this is Atlassian community and we're mainly dealing with Atlassian products I just wanted to mention from your picture the system looks not healty. Just make sure it is not hacked.

Trần Minh Sơn September 2, 2021

Dear all,

I also suffered from this solrd process created / runned by confluence1 user. Is it a bug or a hack ? How can I disable this process please?

Many thanks

Martin Faust September 3, 2021

It is a monero mining malware installed through your confluence instance. Check your crontab of the confluence user...

Like # people like this
Christoph Mussenbrock September 15, 2021

Very helpful. Do you have any idea how this could happen? Is there a vulnerability in confluence?

Nic Brough -Adaptavist-
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
September 16, 2021
Like Jiri Wetter likes this

Suggest an answer

Log in or Sign up to answer
TAGS
AUG Leaders

Atlassian Community Events