Try running find on all the files searching for "/usr/sbin/exim" (or
such), e.g.
find / -exec grep -q "/usr/sbin/exim" {} 2>/dev/null \; -a -exec echo {} \;
> PID TTY STAT TIME COMMAND
> [snip]
> 186 ? S 0:00 /usr/sbin/cron
> [snip]
> 16891 ? S 0:00 /USR/SBIN/CRON
> 16892 ? S 0:00 /bin/sh -c if [ -x /usr/sbin/exim -a -f
> /etc/exim/exim.conf ]; then /usr/sbin/exim -q ; fi
> 16893 ? S 0:00 /usr/sbin/exim -q
> 18318 ? S 0:00 /usr/sbin/exim -q
> 18319 ? S 0:00 /usr/sbin/exim -q
> 18320 ? S 0:00 /usr/bin/procmail
> 18321 ? S 0:00 /usr/sbin/exim -q
If /USR/SBIN/CRON is running over and over again, perhaps every second
or five seconds, this may account for the high PID's.
> I'm fine with #186, but why have I got #16891 there? According to
> pstree, it's the parent of the subsequent exim and procmail
> processes, but there's nothing in my /etc/crontab to suggest that
> anything should be going on around now.
There are other crontabs, though. Some applications use their special
user's crontab. What is the name exim runs under, if once you find it,
do a 'crontab -u EXIMUSERNAME -l'.
It's worth investigating.
Elizabeth
