In article <[🔎] 91dd90da0712301159s3f629c4bsc288aa96a810295d@mail.gmail.com> you wrote: > www-data 16848 1 14 14:01 ? 00:06:07 ping22 Looks like it is started from Apache, most likely a CGI. Have a look at CWD of that process or look into the access log. Gruss Bernd