This question already has an answer here:

I have run a server with 2vcpu and 4 GB of ram. my software setup is apache2+php7.0+drupal-7. I'm facing 100% CPU utilization due to the un-named process called [] and is owned by www-data. (screenshot FYR). looking for solution..click to view top result image

marked as duplicate by Sven linux May 30 '18 at 7:45

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Judging by the fact that it's running as user www-data and it's deliberately un-named, I would guess with high confidence that your server is most likely compromised. Canonical answer here for handling a breached server: How do I deal with a compromised server?

  • after some research, I'm using gdb tool for finding a location of the process. www-data automatically creates the files to /tmp dir. if any possibilities to logging which php file creates this files in tmp directory – kavi britto May 31 '18 at 10:18
  • Take the advice from the link Sven and I posted - ultimately, don't try to salvage it. Nuke the server from orbit and start fresh. – Brennen Smith Jun 4 '18 at 18:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.