strange system users 1011 1012

[explosive]

Hi,

sometimes i've some problems with server - 100% CPU, load 100, for 10 minutes. When i search who and why do some nasty things i've found:

1013     15828  0.0  0.0  30404  5700 ?        S     2011   1:45 /usr/local/php5/bin/php-cgi
1011     15890  0.0  0.0  30988  5308 ?        S    Jan27   0:00 /usr/local/php5/bin/php-cgi
1011     16685  0.0  0.0  30988  5308 ?        S    Jan27   0:00 /usr/local/php5/bin/php-cgi
1011     17025  0.0  0.0  30988  5308 ?        S    Jan27   0:00 /usr/local/php5/bin/php-cgi
1011     17303  0.0  0.0  30988  5308 ?        S    Jan27   0:00 /usr/local/php5/bin/php-cgi
1011     17503  0.0  0.0  30988  5308 ?        S    Jan27   0:00 /usr/local/php5/bin/php-cgi
1011     17752  0.0  0.0  30988  5308 ?        S    Jan27   0:00 /usr/local/php5/bin/php-cgi
1011     17961  0.0  0.0  30988  5308 ?        S    Jan27   0:00 /usr/local/php5/bin/php-cgi

I don't have such users, like 1011, 1012, 1013 etc.
what is this? some system procces or what?!?

When CPU have that 100% i have about 100+ processes like above. It's too much and probably this is why kernel report php crash. ?

Feb  9 11:36:45 kernel: [17058920.782018] php-cgi[14973]: segfault at 206f6f5c ip 08362951 sp bf85f8a0 error 4 in php-cgi[8048000+615000]
Feb  9 11:36:51 kernel: [17058926.898174] php-cgi[15032]: segfault at 206f6f5c ip 08362951 sp bfed61e0 error 4 in php-cgi[8048000+615000]

 

[scsi]

Sometimes it shows the uid when the username is too long.

To find the user you can do:

grep 1011 /etc/passwd | cut -d: -f1

Also might try:

getent passwd 1011 | cut -d: -f1

Both will do the same thing basically.

 

[explosive]

Thank you! You have right! Now i have ugly user, time to find why he makeing so many proccesses.

Anyway username it is not long. its "coolmoneys"

 

[zEitEr]

Thank you! You have right! Now i have ugly user, time to find why he makeing so many proccesses.

Anyway username it is not long. its "coolmoneys"

You might want to use PAM limits to limit a number of concurrent processes; this is what I usually do.

 

[explosive]

Thanks for good hint! Soon we move to CloudLinux so i have hope that it will be the end of that problems.