Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to thank everyone who reads this in advance for donating their time to hear my plea. I will try to be as clear as possible.

What I am trying to do is figure out a way to enable Process Accounting to not only log the CPU usage and associated binary for each process, but if possible, the specific script/files that were loaded into the executable.

For example. This is how process accounting is working for me now [output has been slightly formatted for clarity purposes]:

[~]# lastcomm userexample | awk '$(NF-5)>1{print}'
php             X userexample  __         2.33 secs Fri Dec 28 07:38
perl-bin        X userexample  __         5.19 secs Fri Dec 28 07:38
php             X userexample  __         2.72 secs Fri Dec 28 06:33
php             X userexample  __         2.98 secs Fri Dec 28 04:28
php             X userexample  __         2.69 secs Fri Dec 28 04:23
perl-bin        X userexample  __         5.66 secs Fri Dec 28 04:23
perl-bin        X userexample  __         7.55 secs Fri Dec 28 04:21
perl-bin        X userexample  __         5.84 secs Fri Dec 28 04:28
perl-bin        X userexample  __         6.74 secs Fri Dec 28 06:33
php             X userexample  __         2.05 secs Fri Dec 28 04:21

This is incredibly useful because I now know that this user is responsible for a handful of PHP processes consuming over my specified number of CPU seconds (value of 1)

My problem is that I would LOVE to know which PHP scripts were executed by the php binary for these results. I'm looking for the path and filename.

If I'm seeing output like this:

php             X userexample  __         46352.32 secs Thu Dec 27 03:22
perl-bin        X userexample  __         5.19  secs Fri Dec 28 07:38
php             X userexample  __         2.72  secs Fri Dec 28 06:33

I instantly know, 'OK, the user userexample is running some script somewhere that is extremely long running.'

This is great to know, but if there are thousands of PHP scripts, I am somewhat at a loss unless I can catch it in the act. What I'm looking for is a way to know WHICH script php loaded when this specific php instance was executed. ie, something like, "/home2/userexample/public_html/sh3llz0r.php"

Google is not much help [or maybe I'm not searching properly], so I'm turning to you guys.

If there is not a way to enable such a feature in Process Accounting, is anyone familiar with some other solution or method to achieve my described result?

I'm kind of desperate here and any help would be greatly appreciated. Thanks again!!

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.