OK,
I got this from a server that doest NOT using suExec mod.

11:36pm up 4 days, 10:38, 21 users, load average: 2.77, 2.43, 3.00
170 processes: 167 sleeping, 2 running, 1 zombie, 0 stopped
CPU states: 17.0% user, 7.8% system, 4.4% nice, 76.4% idle
Mem: 257844K av, 223788K used, 34056K free, 101360K shrd, 44736K buff
Swap: 128484K av, 12068K used, 116416K free 55596K cached

28698 nobody 0 0 0 0 0 Z 0 8.7 0.0 0:00 ads.pl <zombie>
28196 nobody 0 0 0 0 0 Z 0 6.4 0.0 0:00 pod.cgi <zombie>
4322 root 20 19 2280 2004 364 R N 0 6.2 0.7 79:58 boot
28700 nobody 0 0 0 0 0 Z 0 1.7 0.0 0:00 ads.pl <zombie>
20018 nobody 0 0 4272 1872 1464 S 0 0.3 0.7 0:00 httpd

My questions is:

How to find which account exacly using that ads.pl script (pid 28698), ads.pl (pid 28700), and pod.cgi script (pid 28196)
I'm just confused because all scripts run as nobody.

Thx.
Soda

You can type:

locate ads.pl

and it will show you where on the server the script is. (Same for the other one).

Thank you.
I know that we can also using find command.
But let say there's so many users in the same server using ads.pl script file, how can we know which account exacly using ads.pl file that make a server almost bog down (take alot of CPU resources)

Thx

You can try using "tail" or writing a simple perl script to check the last few lines of each web-access-log for ads.pl and match it up with the running ads.pl. It will help narrow down which account is running it the most often.