From time to time, I find a command "gzip -f -" running, when I access WHM, process Manager.

Is it a suspect proccess?

Trace shows something like this:

Process 10437 attached - interrupt to quit
read(0, "n line 151, referer: http://www."..., 32768) = 32768
read(0, "] PHP Notice:  Undefined index: "..., 32768) = 32768
read(0, "crap.php?img=filename_20111010"..., 32768) = 32768
read(0, "/home/username/public_html/automa"..., 32768) = 32768
read(0, "n Oct 10 16:48:16 2011] [error] "..., 32768) = 32768
read(0, "151, referer: http://www.domain"..., 32768) = 32768
read(0, "otice:  Undefined index: [object"..., 32768) = 32768
read(0, "p?img=filename_20111010163955o"..., 32768) = 32768
read(0, "crapee/public_html/automatico/se"..., 32768) = 32768
read(0, "0 16:48:16 2011] [error] [client"..., 32768) = 32768
read(0, "ferer: http://www.domain.net/au"..., 32768) = 32768
read(0, " Undefined index: [object HTMLIn"..., 32768) = 32768
read(0, "ilename_20111010163955oZbj0K.g"..., 32768) = 32768
read(0, "public_html/automatico/send_scra"..., 32768) = 32768
link|improve this question

29% accept rate
feedback

1 Answer

gzip is a compression tool, and that data looks like HTTP server logs.

You likely have something like logrotate in place that's automatically compressing your logs.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.