Nobody user taking up 300% CPU?

psm

• June 21, 2018 18:28

I noticed our server has been moving very slow, checked out the current processes and found this nobody user using up 300+% of the CPU for some "!!" Command?? What is going on here? Image attached

• 

  Infopro

  • June 22, 2018 01:28

  I suggest using that kill link, to the left there. That should get your resources back to give you a chance at taking a closer look at things.

  0
• 

  Jcats

  • June 22, 2018 01:29

  Do you have SSH access? I would probably run a lsof on it, if its something malicious, then it will just spawn again at some point. lsof -p 20594
  

  0
• 

  psm

  • June 22, 2018 01:39

  Correct, everytime I kill the process it spawns again with a few files such as "27DeoeDNc" in the tmp dir. Deleting those respawn again. Attached is a screenshot of lsof output

  0
• 

  cPanelMichael

  • June 22, 2018 15:24

  Hello @psm, "Nobody" is the username utilized by the Apache web server. It means the usage is coming from one of your websites. The following resource is a good place to start when troubleshooting the source of the usage: Thank you.

  0

Please sign in to leave a comment.