User is spamming using horde?? and I can't tell who

The load on the server was rising to like 22 or so. I logged in and saw this while running 'top' ....

Code: 
PID    USER   PR  NI  VIRT  RES   SHR   S %CPU %MEM    TIME+    COMMAND
16317 root   15   0 11416 5176 2768 S 18.5    0.5         0:04.78 exim
16215 root   15   0 11688 5080 2772 R 18.2    0.5         0:05.85 exim
So to further investigate I did this....

Code: 
root@server [/usr/local/cpanel/base/horde/imp]# cat /proc/16317/environ
cat: /proc/16317/environ: No such file or directory

root@server [/usr/local/cpanel/base/horde/imp]# cat /proc/16215/cmdline
cat: /proc/16215/cmdline: No such file or directory
I thought that was strange so I kept on repeating that command hoping that something would come up. It eventually showed that the file using all that CPU was...

/usr/local/cpanel/base/horde/imp/compose.php

I could not determine which user was actually using that particular file so I just renamed that compose.php file (so basically made horde useless at this point). Upon renaming the file it completely eliminated the high load and the server went back to like a 1.2 load.

Any ideas for future cases for me to be able to determine more so which user is actually causing that problem? Thank you SOOO much.

 

 

 

 

Top