A suspicious process?

[Julien PHAM]

Hi,

Now that I have implemented spamassassin on my mail server, I often receive mails like this :

lfd on myhostname: Suspicious process running under user sominice
Time: Wed Aug 26 10:28:35 2009 +0200
PID: 12620
Account: sominice
Uptime: 16375 seconds
Executable:
/usr/bin/perl
Command Line (often faked in exploits):
spamd child
Network connections by the process (if any):

And :

lfd on myhostname: Excessive resource usage: sominice (12620)
Time: Wed Aug 26 10:28:35 2009 +0200
Account: sominice
Resource: Process Time
Exceeded: 16375 > 1800 (seconds)
Executable: /usr/bin/perl
Command Line: spamd child
PID: 12620
Killed: No

I receive this message about half an hour to an hour.
Any idea on how I can fix this?

Thanks

[Infopro]

As it says, this is an LFD alert. You'll find more help for that over here:
Process Tracking and csf.pignore - ConfigServer Scripts Forum


HTH

[Julien PHAM]

Thanks for your help, I did what they say on this webpage