On Thu, 27 Mar 2014 17:20:22 -0500 Matt Garman <matthew.garman at gmail.com> wrote: > Anyone seen anything like this? Any thoughts or ideas? Post some data.. This public facing? Are you getting sprayed down by packets? Array? Soft/hard? Someone have screens laying around? Write a trap to catch a process list when the loads spike? Look at crontab(s)? User accounts? Malicious shells? Any guest containers around? Possibilities are sort of endless here. -- People often find it easier to be a result of the past than a cause of the future.