I just picked up a second Raq in the bargain basement three days ago.
The only site I put on it is the main site, with no files yet, except I just put an index.php in there with just a redirector in it and the php doesn't work.

I checked the /var/log/httpd/error and it is full of these since last November:

[Mon Nov 18 13:42:36 2002] [notice] Apache/1.3.20 Sun Cobalt (Unix) mod_ssl/2.8.4 OpenSSL/0.9.6b PHP/4.0.6 mod_auth_pam_
external/0.1 FrontPage/4.0.4.3 mod_perl/1.25 configured -- resuming normal operations
[Mon Nov 18 13:42:36 2002] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Mon Nov 18 13:52:57 2002] [notice] caught SIGTERM, shutting down
[Mon Nov 18 13:55:20 2002] [notice] Apache/1.3.20 Sun Cobalt (Unix) mod_ssl/2.8.4 OpenSSL/0.9.6b PHP/4.0.6 mod_auth_pam_
external/0.1 FrontPage/4.0.4.3 mod_perl/1.25 configured -- resuming normal operations
[Mon Nov 18 13:55:20 2002] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Mon Nov 18 14:06:43 2002] [notice] SIGUSR1 received. Doing graceful restart
[Mon Nov 18 14:06:44 2002] [notice] Apache/1.3.20 Sun Cobalt (Unix) mod_ssl/2.8.4 OpenSSL/0.9.6b PHP/4.0.6 mod_auth_pam_
external/0.1 FrontPage/4.0.4.3 mod_perl/1.25 configured -- resuming normal operations
[Mon Nov 18 14:06:44 2002] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Mon Nov 18 14:06:50 2002] [notice] caught SIGTERM, shutting down

[Tue Mar 18 04:02:15 2003] [notice] SIGHUP received. Attempting to restart
[Tue Mar 18 04:02:17 2003] [notice] Apache/1.3.20 Sun Cobalt (Unix) mod_ssl/2.8.4 OpenSSL/0.9.6b PHP/4.0.6 mod_auth_pam_
external/0.1 FrontPage/4.0.4.3 mod_perl/1.25 configured -- resuming normal operations
[Tue Mar 18 04:02:17 2003] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Mar 19 04:02:15 2003] [notice] SIGHUP received. Attempting to restart
[Wed Mar 19 04:02:17 2003] [notice] Apache/1.3.20 Sun Cobalt (Unix) mod_ssl/2.8.4 OpenSSL/0.9.6b PHP/4.0.6 mod_auth_pam_
external/0.1 FrontPage/4.0.4.3 mod_perl/1.25 configured -- resuming normal operations
[Wed Mar 19 04:02:17 2003] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Thu Mar 20 04:02:15 2003] [notice] SIGHUP received. Attempting to restart
[Thu Mar 20 04:02:18 2003] [notice] Apache/1.3.20 Sun Cobalt (Unix) mod_ssl/2.8.4 OpenSSL/0.9.6b PHP/4.0.6 mod_auth_pam_
external/0.1 FrontPage/4.0.4.3 mod_perl/1.25 configured -- resuming normal operations

These are still happening.

Also I checked the bandwidth usage on RS, and in the history it says I used 24.9 Gigs in the last few days.
All I did was add a few patches, and did a couple of backups from my other Raq about 350MB each.
Thats way more than my other raq with 100 sites on it.

The bandwidth graphs show quite a bit of transfer a few weeks before I got it. Could this be from the previous owner?
MRTG Graphs

I already did the patches, and PMfirewall and chkrootkit.

Should I maybe ask for a clean restore before I put this thing into service?

Thanks

I am nearly 100 % sure - i had the
same "problem" with my box in the
first month. Fill out a RS Trouble Ticket,
and RS Customer service will check and
"fix" it for you.

Q: Should I maybe ask for a clean restore before I put this thing into service?

Yes i guess RS will do it free of charge
( Customers should get a clean box
after ordering if someone ask me :-) )

It seems to be working fine now. I put in a trouble ticket, and they said the old logs were just from the raq that they got the image from, and the bandwidth shown in the monitoring section in the members area is just from the previous owner, and I won't be charged for it if I go over the limit. (athough there's not much chance of that).

congratulations