What PHP scripts are running on my server?

php scripts running

[rubenbla]

Hi:

I suspect my (Fedora Core 3) server is being attacked by a spammer via an insecure PHP mail form. Qmail queue doesn't stop growing up.

My question is, is there any Linux command that shows what php scripts are being run at a certain moment? I found something like:

lsof +r 1 -p `ps axww ¦ grep httpd ¦ grep -v grep ¦ awk ' { if(!str) { str=$1 } else { str=str","$1}}END{print str}'` ¦ grep vhosts ¦ grep php

but it doesn't seem to work.

Thanks for your help.
Rubén.

[MattyMoose]

The easiest would actually be to look through your Apache site logs, I would say... Trying to 'catch' a file request to your php file would be hard to do, since Apache (via mod_php) won't keep your .php file open the whole time, only to read it, then it parses it in memory.

[rubenbla]

Thanks MattyMoose:

I'll try that. The only problem is there are more than 100 access_logs.

Cheers.

[iwannano1]

Use apache mod_status to see all running scripts: [httpd.apache.org...]