Try doing "top c" to see if you can pinpoint the script name - it's probably using quite a bit of resources and most likely a perl or php script. Get a PID from one of the instances and do "lsof -p PID" where PID is the one from your top command. That should tell you where the script is running. Change attributes on the script so that it cannot run, suspend the account then examine the script to make sure that was all that it was doing.
Hope that helps
Hope that helps
| Thread starter | Similar threads | Forum | Replies | Date |
|---|---|---|---|---|
|
Spam from local user delivered without authentication | 2 | ||
| A | Email goes to spam even with valid SPF, DKIM and DMARC records, dynamic rDNS on AWS instance | 1 | ||
| M | Mark and Delete with Spam Assassin | 5 | ||
| W | Best addon Spam service | 2 | ||
| V | Spamassassin causing zombie Exim processes | 1 |