Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Some processes which Apache2 has forked off has extremely high CPU usage. Specifically mine.32 What is it and how can I reduce it's CPU usage?

Top:

PID     USER      PR  NI   VIRT    RES  SHR  S %CPU %MEM    TIME+  COMMAND
10834   www-data  20   0   99108   1284 1012 S  315  0.1 592:21.41 mine.32
11871   www-data  20   0   99108   1276  996 S  315  0.1 114:06.83 mine.32
 8540   www-data  20   0   69816    29m 6976 S    0  2.9   3:49.47 apache2
10069   www-data  20   0   79188    36m 7388 S    0  3.7  41:04.19 apache2
10071   www-data  20   0   74296    31m 7340 S    0  3.2  40:06.74 apache2
10078   www-data  20   0   82144    39m 7500 S    0  4.0  43:36.85 apache2
10079   www-data  20   0   74324    31m 7376 S    0  3.2  37:04.56 apache2
10099   www-data  20   0   74588    31m 7152 S    0  3.2  42:22.07 apache2
10100   www-data  20   0   82024    39m 7384 S    0  3.9  41:21.16 apache2

EDIT

Follow up question: Prevent from shell script executing by Apache

share|improve this question

2 Answers 2

up vote 1 down vote accepted

There is no mine.32 executable part of the Apache package.

Most likely origins:

  • The process was launched as a CGI by apache (check apache logs or mine.32's PPID, is it an apache process)
  • It was started by another means (eg crontab) to run as user www-data (PPID?)
  • The www-data account was compromised (through an insecure site you're hosting) and Arty Bartfast is riding your CPU
share|improve this answer
    
Yes it was compromised. Found it in a wordpress JS directory –  Ryan Schumacher May 2 '13 at 3:31
    
Could you assist with serverfault.com/questions/504324/… –  Ryan Schumacher May 2 '13 at 3:41

you can check full running command instead only command name with top as below

top -c

and also you can check it from process id as below:

cat /proc/<PID>/cmdline

e.g.

cat /etc/10834/cmdline

here you can see what is running in this process or check as below:

ps -aufx |grep mine.32

share|improve this answer
    
Very helpful! Thank you! –  Ryan Schumacher May 2 '13 at 3:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.