Exim starts at night

[iprodua]

Time: 01:40 GMT+2
top with "i" (show active tasks)
==================================
top - 02:37:01 up 1 day, 14:26, 1 user, load average: 19.22, 14.58, 10.96
Tasks: 230 total, 2 running, 216 sleeping, 0 stopped, 12 zombie
Cpu(s): 0.0% us, 3.9% sy, 0.0% ni, 0.0% id, 96.1% wa, 0.0% hi, 0.0% si
Mem: 506968k total, 500992k used, 5976k free, 50620k buffers
Swap: 1052248k total, 76340k used, 975908k free, 49620k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
27372 admin 15 0 2256 1104 800 R 3.9 0.2 0:11.33 top
12032 root 18 0 60156 53m 2216 R 2.0 10.8 1:50.47 dataskq
28232 stkodua 18 0 8076 1192 736 D 0.0 0.2 0:00.00 exim
28235 stkodua 21 0 8076 1192 736 D 0.0 0.2 0:00.00 exim
28237 stkodua 18 0 8068 1188 736 D 0.0 0.2 0:00.00 exim
28238 stkodua 18 0 8080 1192 736 D 0.0 0.2 0:00.00 exim
28277 profitex 18 0 8248 1240 736 D 0.0 0.2 0:00.00 exim
28290 speedua 18 0 8136 1316 828 D 0.0 0.3 0:00.00 exim
28318 stkodua 19 0 8080 1192 736 D 0.0 0.2 0:00.00 exim
28320 stkodua 20 0 8080 1192 736 D 0.0 0.2 0:00.00 exim
28322 stkodua 19 0 8072 1184 736 D 0.0 0.2 0:00.00 exim
28323 stkodua 18 0 8072 1188 736 D 0.0 0.2 0:00.00 exim
28334 titanod 18 0 8136 1316 828 D 0.0 0.3 0:00.00 exim
28340 titanod 18 0 8132 1316 824 D 0.0 0.3 0:00.00 exim
28374 stkodua 19 0 8068 1188 736 D 0.0 0.2 0:00.00 exim
28377 stkodua 18 0 8080 1196 736 D 0.0 0.2 0:00.00 exim
28378 stkodua 18 0 8072 1192 736 D 0.0 0.2 0:00.00 exim
===========================

What is this? Is this a spam?

 

[iprodua]

After 5 minutes

top - 03:16:14 up 1 day, 15:05, 1 user, load average : 98.82, 87.19, 65.45
Tasks: 602 total, 3 running, 515 sleeping, 0 stopped, 84 zombie
Cpu(s): 100.0% us, 0.0% sy, 0.0% ni, 0.0% id, 0.0% wa, 0.0% hi, 0.0% si
Mem: 506968k total, 498468k used, 8500k free, 18288k buffers
Swap: 1052248k total, 98184k used, 954064k free, 29180k cached

 

[nobaloney]

Look at the second column; that's the username of the user calling email; the top command is showing you that user stkodua is calling exim a lot of times. Look for a php program running as user stkodua.

Jeff