I have noticed that an unknown mysqldump command is being executed on my system. But I have not configured my system to issue that command. Following is the output when I do ps aux | grep mysqldump
500 28651 0.0 0.0 7892 1852 ? Ss 00:26 0:01 /usr/bin/mysqldump --opt --default-character-set=utf8 --skip-extended-insert --allow-keywords --quote-names --compact --complete-insert --skip-lock-tables --quick --skip-comments --host=localhost --user=database_user --password=x xxxxxxxxxxxxxxxxxxx database atable
500 is probably uid for my own user account (and only one that has bash access)
I have tried everything, like last
, history
and cron logs but unable to find the source.
How to find who is executing this particular command on my system?
UPDATE:
This is getent passwd 500
output:
myusername:x:500:500::/home/myusername:/bin/bash
It happened again and now I have more info
This is cat /proc/28126/status
Name: mysqldump
State: S (sleeping)
SleepAVG: 98%
Tgid: 28126
Pid: 28126
PPid: 28108
TracerPid: 0
FNid: 10048627
Uid: 500 500 500 500
Gid: 500 500 500 500
FDSize: 64
Groups: 500 501
This is output for ps auxf | grep mysqldump
500 28126 0.0 0.0 7892 1852 ? Ss 08:05 0:01 \_ /usr/bin/mysqldump --opt --default-character-set=utf8 --skip-extended-insert --allow-keywords --quote-names --compact --complete-insert --skip-lock-tables --quick --skip-comments --host=localhost --user=datebase_user --password=x xxxxxxxxxxxxxxxxxxx database anothertable
UPDATE 2:
This is output for ps aux | grep 28108
500 28108 0.1 0.0 10504 2024 ? S 08:05 0:04 sshd: myusername@notty
Oh, looks like someone has sshd but how to find the IP?
netstat -pant
and look for ESTABLISHED ssh connections.