0

I have run a server with 2vcpu and 4 GB of ram. my software setup is apache2+php7.0+drupal-7. I'm facing 100% CPU utilization due to the un-named process called [] and is owned by www-data. (screenshot FYR). looking for solution..click to view top result image

0

1 Answer 1

0

Judging by the fact that it's running as user www-data and it's deliberately un-named, I would guess with high confidence that your server is most likely compromised. Canonical answer here for handling a breached server: How do I deal with a compromised server?

2
  • after some research, I'm using gdb tool for finding a location of the process. www-data automatically creates the files to /tmp dir. if any possibilities to logging which php file creates this files in tmp directory May 31, 2018 at 10:18
  • Take the advice from the link Sven and I posted - ultimately, don't try to salvage it. Nuke the server from orbit and start fresh. Jun 4, 2018 at 18:58

Not the answer you're looking for? Browse other questions tagged .