I see my load average go up to 2.00 or 3.00. I wanted to know how can I find out specifically what is using the most reasources right then. In shell the command "top" shows the above info but how do I trace a certain PID to a certain account or user?

Also, many times the high process is "exim" and it dosen't make sense it's emailing that much, where can I look to see what accounts is "exim" executing for.

And in general, where can I see (in WHM or shell) a detailed log of bandwidth used for a certain user, including his email, http, ftp etc... (mainly email I guess).


Thanks much

P.S. some users have complained that their bandwidth jumped to 100MB or even 1000MB in, like, 1 day and that it's impossible cuz they never used that much, where can I investigate that (i.e. what is using that bandwidth)?

Top should already show you the user running the process, except for some daemons such as exim, apache, php (if you aren't running phpsuexec).

You can try checking the spooling queue probably.

in WHM, you can check using View Bandwidth Function under Account functions. It's almost 100%. Almost.

Sometimes it may be
1. Cpanel reporting wrongly
2. Their accounts are compromised.
etc.

Check their account directory and see if there's any suspicious files for point 2. For 1, well, you can try to read that off against bandmin possibly and see if you get a better guage.

You can also check the logs (e.g. xferlog) to see what's being transferred the most by grepping his user name.

Originally posted by WHdot

Also, many times the high process is "exim" and it dosen't make sense it's emailing that much, where can I look to see what accounts is "exim" executing for.


Your server is probably being used by spammers. Check in your Mail Quene, trace who is sending the space, save the headers, and report it. Then Clear your Mail Quene and your CPU load should come back to normal.