gam_server??

[esezako]

Hi, emails users of ispconfig are used to send spam days ago.

After change passwords of this users stop spam, but in top always appear this:

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                        
11952 web26_au  20   0  2564 1136  984 S    0  0.0   0:00.00 gam_server                                                                                      
11956 web26_ba  20   0  2564 1132  984 S    0  0.0   0:00.00 gam_server                                                                                      
11974 web26_ba  20   0  3412 1024  836 S    0  0.0   0:00.12 imapd                                                                                           
12065 web26_au  20   0  3412 1040  840 S    0  0.0   0:00.10 imapd

what is gam_server?
is the server hacked?

[Mark_NL]

From the website http://people.gnome.org/~veillard/gamin/

Gamin is a file and directory monitoring system defined to be a subset of the FAM (File Alteration Monitor) system. This is a service provided by a library which allows to detect when a file or a directory has been modified.

[esezako]

OK, and why always this users are in top output?

[Mark_NL]

You can always see those in top, since it's a process that's running .. :/

[esezako]

minimun 2 days

[esezako]

i kill this process but this reappear

[Mark_NL]

is it causing you problems then? You can just let it run ..

[esezako]

But only appear process for users of web26 (i have > 200 sites) and not finished never.

Why?

[falko]

Is it maybe started by a cron job?

[esezako]

i think not.

crontab -l

30 00 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/logs.php &> /dev/null
59 23 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/ftp_logs.php &> /dev/null
59 23 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/mail_logs.php &> /dev/null
59 23 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/cleanup.php &> /dev/null
0 4 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/webalizer.php &> /dev/null
0,30 * * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/check_services.php &> /dev/null
15 3,15 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/quota_msg.php &> /dev/null
40 00 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/traffic.php &> /dev/null
05 02 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/backup.php &> /dev/null
0 4 * * * /root/ispconfig/php/php /root/ispconfig/scripts/shell/awstats.php &> /dev/null