CPU usage

[skoena]

I have a huge cpu usage on PERL? What could be causing this?

13799 www-data 20 0 4720 2408 980 R 99 0.1 3958:33 perl

[till]

Its a perl script running in one of your websites.

[skoena]

Is there a way to find out which script is causing this?

[skoena]

klogd -x is eating my CPU.
What can I do about it?

32131 www-data 20 0 4720 2336 912 R 101 0.1 93:06.68 klogd -x

[till]

Try to find the program file with the find command, I guess it must be somwhere in /var/www or /tmp (not in /usr or other system directories). This is most likely a hcked or trojan script that uses the name of a common Linux application (klogd) to hide itself. But the real klogd would never run as www-data, so this fake program must be somewhere in one of your sites or in the tmp folder.

[skoena]

Till,
Tnx when the CPU is high again will try fo FIND it. (with "FIND KLOGD" right?)

Btw when I reboot the server the high usage and the klogd is stopped.

[till]

Linux is case sensitive, so the find command as well as the name of the application have to be in lowercase. See:

man find

for all options of the find command.

[skoena]

Tried to find klogd but
"find: `klogd': No such file or directory"

This issue is not always running, 1 per 2 weeks this issue is there.

[cfoe]

Originally Posted by skoena

Tried to find klogd but
"find: `klogd': No such file or directory"

This issue is not always running, 1 per 2 weeks this issue is there.

if it is malware then there is some kind of vulnerability to let it get uploaded and started. When you restart the process is not run on startup but the vulnerability is still there. It might be exploited again when the "hacker" realizes it is not running anymore.

[skoena]

Tnx.
Any tips for locating the script that is causing this?
Because "find klogd" is not working.