I would like to know how you find out which php-scripts are starting apache2-processes, which are causing high load.

It seems that one user is infected with malware (php-shell). LMD (maldet/maldetect) does not find the file, but there are php-processes that cause a high CPU load from time to time.

Now I would like to know which file started the apache2-process.

With strace I do not get the filename or -path.

Any ideas?


maybe you find some clue with:

lsof | grep <PID>

(insert the PID of the suspicous process instead of )

This shows you which files/sockets that process has opened.


You may not be seeing the output you want because strace does not follow children/forks by default, try using strace -f -p $PID -e trace=open,close to filter open() and close() calls to any children or threads of that $PID (php-shell it sounds like). Here is a handy strace cheat sheet I like to use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.