How to find a script that is running wild on server

Discussion in 'Site & Server Administration' started by midwestbonsai, Jul 29, 2010.

0
  1. #1
    Hello,

    I have the Extreme (dv) server over at media temple.

    60 GB HD
    2 GB RAM
    2 TB Bandwidth

    * CentOS release 5 (Final)
    * Apache (version 2.2.3)
    * Perl (version 5.8.8)
    * PHP (version 5.2.5)
    * MySQL (version 5.0.22)

    I have a script somewhere, I think I know what domain (I have many), that is eating up all of my RAM and making all site unviewable and constantly crashing plesk.

    Because this is an un managed server their support team is pretty un willing to help me. I cannot figure out where this script is. And I am not the most knowledgeable via ssh.

    Do any of you have any tips or suggestions?
     
    midwestbonsai, Jul 29, 2010 IP
  2. iTube

    iTube Active Member

    Messages:
    239
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    75
    #2
    to start with, use top on your linux shell and it gives you a list of processes, and you should be able to find out the name of the process that is loading the mem, then updatedb as root, and locate <file>
     
    iTube, Jul 29, 2010 IP
  3. midwestbonsai

    midwestbonsai Well-Known Member

    Messages:
    402
    Likes Received:
    9
    Best Answers:
    0
    Trophy Points:
    105
    #3
    when I do top, php-cgi is the most memory. Not sure what you mean when you say the updatedb
     
    midwestbonsai, Jul 30, 2010 IP
  4. AnthonyG

    AnthonyG Well-Known Member

    Messages:
    114
    Likes Received:
    3
    Best Answers:
    2
    Trophy Points:
    135
    #4
    with php running as a cgi, your not going to get any useful log data anyways.

    from the cmd prompt in ssh type: updatedb (then hit enter on the kb)

    
updatedb definition:
This manual page documents the GNU version of updatedb, which updates file name databases used by GNU locate. The file name databases contain lists of files that were in particular directory trees when the databases were last updated. The file name of the default database is determined when locate and updatedb are configured and installed. The frequency with which the databases are updated and the directories for which they contain entries depend on how often updatedb is run, and with which arguments.
    Code (markup):
    im unsure how itube gets a file name to show in top, but im all ears on how he does that?

    what you could do is strace the pid in question using the ram like so, pipe it to a file, you wont keep up trying to view it via stderr.
    
example cmd:
strace -p 15048 -o /var/log/ram-sucking-script.txt (15048 is the PID in question using the ram.)
    Code (markup):
    this will store anything that pid is doing, there will be a lot of data in the file, but you should be able to track it down.
     
    AnthonyG, Jul 30, 2010 IP