Not sure if it's helpful or not, but these are the process that have something open from /var/cache/nscd/ : amavisd-n anvil apache2 bash cron dbus-daem dhcpd3 dovecot-a imap login mailmanct master named nrpe nscd ntpd pickup qmgr saslauthd slapd smbd smtpd sshd su tlsmgr verify