0

I have noticed that an unknown mysqldump command is being executed on my system. But I have not configured my system to issue that command. Following is the output when I do ps aux | grep mysqldump

500      28651  0.0  0.0   7892  1852 ?        Ss   00:26   0:01 /usr/bin/mysqldump --opt --default-character-set=utf8 --skip-extended-insert --allow-keywords --quote-names --compact --complete-insert --skip-lock-tables --quick --skip-comments --host=localhost --user=database_user --password=x xxxxxxxxxxxxxxxxxxx database atable

500 is probably uid for my own user account (and only one that has bash access)

I have tried everything, like last, history and cron logs but unable to find the source.

How to find who is executing this particular command on my system?

UPDATE: This is getent passwd 500 output:

myusername:x:500:500::/home/myusername:/bin/bash

It happened again and now I have more info

This is cat /proc/28126/status

Name:   mysqldump
State:  S (sleeping)
SleepAVG:       98%
Tgid:   28126
Pid:    28126
PPid:   28108
TracerPid:      0
FNid:   10048627
Uid:    500     500     500     500
Gid:    500     500     500     500
FDSize: 64
Groups: 500 501

This is output for ps auxf | grep mysqldump

500      28126  0.0  0.0   7892  1852 ?        Ss   08:05   0:01          \_ /usr/bin/mysqldump --opt --default-character-set=utf8 --skip-extended-insert --allow-keywords --quote-names --compact --complete-insert --skip-lock-tables --quick --skip-comments --host=localhost --user=datebase_user --password=x xxxxxxxxxxxxxxxxxxx database anothertable

UPDATE 2: This is output for ps aux | grep 28108

500      28108  0.1  0.0  10504  2024 ?        S    08:05   0:04 sshd: myusername@notty

Oh, looks like someone has sshd but how to find the IP?

10
  • Check that uid please: getent passwd 500; Show us cat /proc/28651/status (Uid: Gid: and Groups: lines) and also look at parent of this process: ps auxf.
    – kupson
    Feb 14, 2012 at 15:05
  • Please see update above. Basically 500 uid is my own useraccount (but I did not even touch the keyboard at that time). Since I restarted mysql to bring my site back, I can't run other commands... Feb 14, 2012 at 15:27
  • It happened again, this time I have got more info... please see update above. Feb 14, 2012 at 15:46
  • 1
    If you're trying to figure out the client IP of the ssh connection, run netstat -pant and look for ESTABLISHED ssh connections.
    – cjc
    Feb 14, 2012 at 16:18
  • 1
    Uh, don't you want them to back up your database, if they're a backup company?
    – cjc
    Feb 14, 2012 at 16:32

2 Answers 2

1

getent passwd 500 should tell you which user has uid 500. Since the tty column is a ? it doesn't appear that it is attached to a particular login currently. (though that could mean that someone launched it interactively then disowned it.

I'd wonder if you have a backup scheduled in cron which you don't know about. You could check that user's crontab with crontab -l -u username or cat /var/spool/cron/crontabs/username, and check in directories like /etc/cron.d /etc/cron.daily /etc/cron.hourly

2
  • Its my own user account with that uid. Though I previously checked cron logs for any particular culprit and didn't find any but I will recheck. Feb 14, 2012 at 15:35
  • Its not cron, I have updated my answer with more updates... Feb 14, 2012 at 15:46
1

add --forest to your ps command. This will show you parent/child relationships of all your processes. You should then just be able to walk up the tree until you find whats starting it.

2
  • oh I restarted again before I could run this command... but see more info above Feb 14, 2012 at 15:53
  • Thanks, Patrick ! alias psf="ps --forest" just went into my .bashrc
    – Dmitri
    Feb 14, 2012 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .