Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive
 

Some thing you can do to see what is running etc..


ps aux|grep ^nobody
ps aux|grep sh
ls -al /tmp|grep -v sess




I'd also check /dev/shm (if it's 777), /var/tmp (if it's not symlinked to /tmp), and everything in /tmp.

Furthermore, you may want to look into using suexec and phpsuexec.