Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On my Linux server, i am getting a suspicious perl process, which is trying to send spam from my server, using a perl script. Here is the ps -aux output.

apache     10078  0.0  0.0   4028   705 pts/1    S+   15:50   0:00 [perl]
apache     10079  0.0  0.0   4023   433 pts/1    S+   15:50   0:00 [perl]
apache     10080  0.0  0.0   4024   432 pts/1    S+   15:50   0:00 [perl]
.
.
.

There are more than 20 of such processes running and each one of them is consuming a lot of Sockets.

unable to find the script's location, path and detail as its just "perl" written there. I tried to use lsof to see its opened files, it shows a big number of sockets and files opened by one website hosted on my server. but i cannot get a clue from there that which script is this, so that i can track and remove it.

Thanks

share|improve this question
add comment

2 Answers 2

up vote 2 down vote accepted

lsof -p against the relevant process ID's will tell you where to look...

For instance, lsof -p 10078 will give you a listing of all the open files associated with that process. Take a look at the output and work back to see which files are in use.

share|improve this answer
    
that i have already tried. but does it reveals the information about the actual path of the script? that where it is located? –  Farhan Nov 7 '12 at 16:04
    
It's probably a CGI script. Restart Apache and see if it goes away. –  ewwhite Nov 7 '12 at 16:08
    
it does go away but comes back at random intervals in a day. –  Farhan Nov 7 '12 at 16:11
add comment

I found a solution using which you can know the Exact path of the system/kernel perocess, enclosed in brackets , like [perl]

readlink -f /proc/{PID of process}/exe
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.