[CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

On Wed, 2009-06-03 at 11:06 -0400, William L. Maltby wrote:
> <snip>

I just thought of this too.

There are two IDs tracked by the system. Effective (EUID) and the real
ID (UID). If the process has changed UID, by either suid bit or by
program call (I think it has to start as root for that to happen?), you
can run ps with a flag that will show you the real and/or EUID.

That might provide a clue as well.

HTH
-- 
Bill