Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Here is out of ps aux| grep atd on my server.

apache    1299  0.0  0.0   5328  2768 ?        S    08:21   0:00 /usr/sbin/atd
root     15407  0.0  0.0   4020   708 pts/3    S+   11:02   0:00 grep atd
apache   16506  0.0  0.0   5328  2808 ?        S    08:52   0:00 /usr/sbin/atd

The process atd is not even present on its physical path, but the above path shows that it is there and its running under apache. how to track and detect its activity?

share|improve this question

closed as off-topic by Jenny D, Sven, MichelZ, mdpc, Wesley Apr 25 at 15:50

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – Jenny D, Sven, MichelZ
If this question can be reworded to fit the rules in the help center, please edit the question.

    
That looks like the regular at daemon. man atd should tell you more. –  Jenny D Apr 23 at 10:17
    
but why its running under apache as well as i have moved its executable from its original location. –  Farhan Apr 23 at 10:19
    
Moving the binary doesn't make the running process disappear; why would it? As for why it's running under apache - that would be because it was invoked by the apache user. Please read man at and man atd –  Jenny D Apr 23 at 10:26
    
the executable has been many times killed and server is restarted as well. when its not even present at its original location, how can apache run it? from where? when it does not even exist? –  Farhan Apr 23 at 10:27

2 Answers 2

If you don't give us all the information then it's difficult for us to help diagnose your problem/answer your question.

Based upon your coyness I'm going to guess that your system has been compromised and you know what's coming now

Reinstall your system

Reinstall the system it's the only way to be sure.

share|improve this answer

First: Stop sabotaging your own system. Randomly deleting files because you don't know what they are doing is a very bad idea.

Second: It runs under the apache uid because it's doing things on it's behalf and even if you delete the file, it won't get really deleted until the last process referencing it terminates, and since atd is a daemon, that is not the case before you terminate it or reboot the system.

share|improve this answer
    
i was aware of its activity, there was a reason to move the binary file,that i have not mentioned it here. and server is rebooted already –  Farhan Apr 23 at 10:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.