lsof getting ran by root, but not by a user and using high CPU usage

Question

My server is using high CPU usage from lsof, and it appears to be ran randomly and by the root user. I'm finding this out via Newrelic information

Is it at all possible to find what is running this and stopping it?

Extra info: Some of the major apps I'm using and have installed:

When I perform a ps -feww | grep lsof it always just returns the grep command itself, it never seems to be running when I'm looking at it.

score 2 · Accepted Answer · answered Apr 22 '14 at 06:04

2

If you use auditd, you can then create a rule such as

auditctl -a exit,always -F path=/usr/sbin/lsof

Then see the /var/log/audit.log or use aureport and ausearch utilities.

answered Apr 22 '14 at 06:04

Janne Pikkarainen

I've never heard of auditd before, I will run this and I'll mark your answer as best if it works, thanks! – Mattisdada Apr 22 '14 at 22:59

1 Answers1