Web Hosting Talk : Web Hosting Main Forums : Dedicated Server : How can I know the abuser user? :(

[Costaud]

Hello,

Here's the result of running "top" command on my server:

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

9661 nobody 20 4 22628 12m 3516 S 6 0.3 0:29.87 httpd
9682 nobody 20 4 23772 13m 3500 S 6 0.3 0:28.16 httpd
9673 nobody 19 4 24836 12m 3772 S 2 0.3 0:28.83 httpd
14027 mysql 21 6 364m 211m 3108 S 2 5.2 288:38.86 mysqld
24350 nobody 19 4 22060 10m 2916 S 2 0.3 0:01.01 httpd
24451 nobody 20 4 21956 10m 2820 S 1 0.3 0:00.21 httpd
24555 nobody 19 4 0 0 0 Z 1 0.0 0:00.02 httpd <defunct>
9676 nobody 19 4 23696 13m 3500 S 0 0.3 0:31.72 httpd
14424 nobody 19 4 23468 12m 3544 S 0 0.3 0:20.19 httpd
24543 nobody 19 4 21876 10m 2780 S 0 0.3 0:00.14 httpd

How can I know who "nobody"? Will installing phpsuexec help?

Please advise. Thanks.

[bithost(NET)]

Which control panel are you running on this server?

Bailey

[bear]

That doesn't appear to be abuse, but instead normal web traffic. PHPSUExec will only tell you the username that spawned it if it's a PHP script.

[mooxe]

Try "netstat -p" It will show you the IP which can cross reference elsewhere.

[Costaud]

I'm using cPanel.

Thanks.

[bithost(NET)]

OK. Rather than trying to teach you command line...

The easiest way to do this is to login to WHM as root, then go to Server Status and click on Apache Status.

You will be given a page that lists all the current Apache connections. Scroll down past the ..... 's until you see the chart of information.

If you have one user that is getting a ton of traffic, it will be obvious, as their website will be listed over and over in the chart under "Vhost." If you scroll to the right of the Apache Status page, you will see that the domain name, and file path of the pages/files being called, are all listed.

A few notes about what you are looking at:

Host is the IP address of the viewer looking at the pages.
Vhost is the domain name of the website on your server that is being viewed.
Request is the path of the file they are looking at.

Keep clicking on "Apache Status" it to see the latest output. It is in real-time. Most Apache calls last < 1 second, so everytime you click, you should get different results.

Let me know if you have any questions --

Bailey

[Costaud]

Thank you very very much, Bailey. That helped me a lot.

[bithost(NET)]

Excellent!

Bailey