How to deal with Overload by "nobody" running Perl

[jdan6@2003]

Hello,

I recently noticed our server was overloaded by the user "nobody" running Perl. How do I find out who is running it and what script he is running?

From the command "top", I can only see the user is "nobody" and the command is "Perl". I would like to find out the offender and stop it.

Thanks for your help.
cpu

[bijo]

Hello,

I recently noticed our server was overloaded by the user "nobody" running Perl. How do I find out who is running it and what script he is running?

From the command "top", I can only see the user is "nobody" and the command is "Perl". I would like to find out the offender and stop it.

Thanks for your help.
cpu

Hello,

Did you enable suexec?. If it is a mail scripts you can find out it after enabling suexe.
Then run the following command

tail -f /usr/local/apache/logs/suexec_log

Also you can check the apache usage in WHM.

May be it will help you to find out the problem.

Let me know the status.

[chirpy]

You can also find out more of the command line by pressing c when in top. You can also look at the continaers in /proc/PID/

Then search the forums as the topic has been covered many times.

[Jorge]

check at your /tmp folder if you see something unusual, I bet that is some kind of exploit running on your server