Checking syslog, bind, and sshd on a healthy system:
---------------------------------------
PID TT STAT TIME COMMAND
(there's two syslog processes)
0000 ?? Is 1:41.77 syslogd: [priv] (syslogd)
00000 ?? I 7:26.02 syslogd -a /var/named/dev/log -a /var/empty/dev/log
(there's two named processes for bind)
00000 ?? IWs 0:00.02 named: [priv] (named)
00000 ?? I 3907:04.59 named -t /var/named -u named
(there's one sshd daemon)
00000 ?? Is 22:53.18 /usr/sbin/sshd
(and this sshd process for a remote user)
00000 ?? Is 0:00.56 sshd: root@ttyp0 (sshd)