Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have noticed that an unknown mysqldump command is being executed on my system. But I have not configured my system to issue that command. Following is the output when I do ps aux | grep mysqldump

500      28651  0.0  0.0   7892  1852 ?        Ss   00:26   0:01 /usr/bin/mysqldump --opt --default-character-set=utf8 --skip-extended-insert --allow-keywords --quote-names --compact --complete-insert --skip-lock-tables --quick --skip-comments --host=localhost --user=database_user --password=x xxxxxxxxxxxxxxxxxxx database atable

500 is probably uid for my own user account (and only one that has bash access)

I have tried everything, like last, history and cron logs but unable to find the source.

How to find who is executing this particular command on my system?

UPDATE: This is getent passwd 500 output:

myusername:x:500:500::/home/myusername:/bin/bash

It happened again and now I have more info

This is cat /proc/28126/status

Name:   mysqldump
State:  S (sleeping)
SleepAVG:       98%
Tgid:   28126
Pid:    28126
PPid:   28108
TracerPid:      0
FNid:   10048627
Uid:    500     500     500     500
Gid:    500     500     500     500
FDSize: 64
Groups: 500 501

This is output for ps auxf | grep mysqldump

500      28126  0.0  0.0   7892  1852 ?        Ss   08:05   0:01          \_ /usr/bin/mysqldump --opt --default-character-set=utf8 --skip-extended-insert --allow-keywords --quote-names --compact --complete-insert --skip-lock-tables --quick --skip-comments --host=localhost --user=datebase_user --password=x xxxxxxxxxxxxxxxxxxx database anothertable

UPDATE 2: This is output for ps aux | grep 28108

500      28108  0.1  0.0  10504  2024 ?        S    08:05   0:04 sshd: myusername@notty

Oh, looks like someone has sshd but how to find the IP?

share|improve this question
    
Check that uid please: getent passwd 500; Show us cat /proc/28651/status (Uid: Gid: and Groups: lines) and also look at parent of this process: ps auxf. –  kupson Feb 14 '12 at 15:05
    
Please see update above. Basically 500 uid is my own useraccount (but I did not even touch the keyboard at that time). Since I restarted mysql to bring my site back, I can't run other commands... –  Arpit Tambi Feb 14 '12 at 15:27
    
It happened again, this time I have got more info... please see update above. –  Arpit Tambi Feb 14 '12 at 15:46
1  
If you're trying to figure out the client IP of the ssh connection, run netstat -pant and look for ESTABLISHED ssh connections. –  cjc Feb 14 '12 at 16:18
1  
Uh, don't you want them to back up your database, if they're a backup company? –  cjc Feb 14 '12 at 16:32
show 5 more comments

2 Answers 2

add --forest to your ps command. This will show you parent/child relationships of all your processes. You should then just be able to walk up the tree until you find whats starting it.

share|improve this answer
    
oh I restarted again before I could run this command... but see more info above –  Arpit Tambi Feb 14 '12 at 15:53
    
Thanks, Patrick ! alias psf="ps --forest" just went into my .bashrc –  Dmitri Feb 14 '12 at 15:57
add comment

getent passwd 500 should tell you which user has uid 500. Since the tty column is a ? it doesn't appear that it is attached to a particular login currently. (though that could mean that someone launched it interactively then disowned it.

I'd wonder if you have a backup scheduled in cron which you don't know about. You could check that user's crontab with crontab -l -u username or cat /var/spool/cron/crontabs/username, and check in directories like /etc/cron.d /etc/cron.daily /etc/cron.hourly

share|improve this answer
    
Its my own user account with that uid. Though I previously checked cron logs for any particular culprit and didn't find any but I will recheck. –  Arpit Tambi Feb 14 '12 at 15:35
    
Its not cron, I have updated my answer with more updates... –  Arpit Tambi Feb 14 '12 at 15:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.