rubenbla - 11:00 am on Dec 7, 2007 (gmt 0)

Hi:

I suspect my (Fedora Core 3) server is being attacked by a spammer via an insecure PHP mail form. Qmail queue doesn't stop growing up.

My question is, is there any Linux command that shows what php scripts are being run at a certain moment? I found something like:

lsof +r 1 -p `ps axww ¦ grep httpd ¦ grep -v grep ¦ awk ' { if(!str) { str=$1 } else { str=str","$1}}END{print str}'` ¦ grep vhosts ¦ grep php

but it doesn't seem to work.

Thanks for your help.
Rubén.