Output from ps:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 2160 644 ? Ss Jul04 0:01 init [3]
root 2 0.0 0.0 0 0 ? S< Jul04 0:00 [migration/0]
root 3 0.0 0.0 0 0 ? SN Jul04 0:00 [ksoftirqd/0]
root 4 0.0 0.0 0 0 ? S< Jul04 0:00 [events/0]
root 5 0.0 0.0 0 0 ? S< Jul04 0:00 [khelper]
root 6 0.0 0.0 0 0 ? S< Jul04 0:00 [kthread]
root 9 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [kblockd/0]
root 10 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [kacpid]
root 169 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [cqueue/0]
root 172 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [khubd]
root 174 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [kseriod]
root 238 0.0 0.0 0 0 ? S Jul04 0:00 \_ [khungtaskd]
root 239 0.0 0.0 0 0 ? D Jul04 0:00 \_ [pdflush]
root 240 0.0 0.0 0 0 ? D Jul04 0:00 \_ [pdflush]
root 241 0.0 0.0 0 0 ? S< Jul04 0:01 \_ [kswapd0]
root 242 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [aio/0]
root 460 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [kpsmoused]
root 490 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [mpt_poll_0]
root 491 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [mpt/0]
root 492 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [scsi_eh_0]
root 495 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [ata/0]
root 496 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [ata_aux]
root 501 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [kstriped]
root 510 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [ksnapd]
root 521 0.0 0.0 0 0 ? D< Jul04 0:30 \_ [kjournald]
root 546 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [kauditd]
root 1674 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [kmpathd/0]
root 1675 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [kmpath_handlerd]
root 1730 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [kjournald]
root 1932 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [kjournald]
root 1952 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [iscsi_eh]
root 1999 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [ib_addr]
root 2006 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [ib_mcast]
root 2007 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [ib_inform]
root 2008 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [local_sa]
root 2011 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [iw_cm_wq]
root 2014 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [ib_cm/0]
root 2017 0.0 0.0 0 0 ? S< Jul04 0:00 \_ [rdma_cm]
root 24530 0.0 0.0 0 0 ? D 19:01 0:00 \_ [pdflush]
root 579 0.0 0.0 2392 728 ? S<s Jul04 0:00 /sbin/udevd -d
root 1931 0.0 0.0 0 0 ? S< Jul04 0:00 [loop0]
root 2032 0.0 0.0 22456 424 ? Ssl Jul04 0:00 brcm_iscsiuio
root 2037 0.0 0.0 3700 432 ? Ss Jul04 0:00 iscsid
root 2038 0.0 0.4 4156 4152 ? S<Ls Jul04 0:00 iscsid
root 2281 0.0 0.0 12648 820 ? S<sl Jul04 0:02 auditd
root 2283 0.0 0.0 12172 804 ? S<sl Jul04 0:01 \_ /sbin/audispd
root 2362 0.0 0.0 1816 580 ? Ds Jul04 0:04 syslogd -m 0
root 2365 0.0 0.0 1764 404 ? Ss Jul04 0:01 klogd -x
dbus 2453 0.0 0.0 2848 856 ? Ss Jul04 0:00 dbus-daemon --system
root 2467 0.0 0.0 1760 540 ? Ss Jul04 0:00 /usr/sbin/acpid
68 2480 0.0 0.4 6240 4232 ? Ss Jul04 0:01 hald
root 2481 0.0 0.0 3264 1016 ? S Jul04 0:00 \_ hald-runner
68 2493 0.0 0.0 2108 808 ? S Jul04 0:00 \_ hald-addon-acpi: listening on acpid socket /var/run/acpid.socket
68 2494 0.0 0.0 2108 804 ? S Jul04 0:00 \_ hald-addon-keyboard: listening on /dev/input/event0
root 2502 0.0 0.0 2060 656 ? S Jul04 2:22 \_ hald-addon-storage: polling /dev/hdc
root 2546 0.0 0.1 28472 1508 ? Ssl Jul04 0:00 automount
named 2568 0.0 0.3 39476 3948 ? Ssl Jul04 0:09 /usr/sbin/named -u named
root 2586 0.0 0.6 27464 6432 ? Sl Jul04 0:06 /usr/sbin/snmpd -Lsd -Lf /dev/null -p /var/run/snmpd.pid -a
root 2603 0.0 0.1 7208 1044 ? Ss Jul04 0:00 /usr/sbin/sshd
root 23649 0.0 0.2 10056 2920 ? Ss 18:52 0:00 \_ sshd: root@pts/0
root 23655 0.0 0.1 4632 1440 pts/0 Ss 18:52 0:00 \_ -bash
root 24440 0.7 0.0 3964 636 pts/0 D+ 19:00 0:00 \_ dd if /dev/zero of test bs 64k count 16k conv fdatasync
root 3291 0.0 0.1 7676 1492 ? Ss Jul04 0:00 pure-ftpd (SERVER)
root 3293 0.0 0.0 7136 916 ? S Jul04 0:00 /usr/sbin/pure-authd -s /var/run/ftpd.sock -r /usr/sbin/pureauth
root 3306 0.0 0.1 5388 1116 ? Ss Jul04 0:00 crond
root 24459 0.0 0.1 5984 1532 ? S 19:01 0:00 \_ crond
root 24466 0.0 0.0 2500 964 ? Ss 19:01 0:00 | \_ /bin/bash /usr/bin/run-parts /etc/cron.hourly
root 24467 0.0 0.2 4568 2760 ? D 19:01 0:00 | \_ /usr/bin/perl /etc/cron.hourly/modsecparse.pl
root 24468 0.0 0.0 2248 584 ? S 19:01 0:00 | \_ awk -v progname=/etc/cron.hourly/modsecparse.pl progname {????? print progname ":\n"????? progname="";???? }???? { print; }
root 24560 0.0 0.1 5564 1036 ? D 19:02 0:00 \_ crond
root 24561 0.0 0.0 5532 1000 ? R 19:02 0:00 \_ crond
root 24562 0.0 0.0 5532 1004 ? D 19:02 0:00 \_ crond
root 3601 0.0 0.0 3612 432 ? S Jul04 0:00 /usr/sbin/smartd -q never
root 3604 0.0 0.0 1748 444 tty1 Ss+ Jul04 0:00 /sbin/mingetty tty1
root 3605 0.0 0.0 1748 468 tty2 Ss+ Jul04 0:00 /sbin/mingetty tty2
root 3606 0.0 0.0 1748 472 tty3 Ss+ Jul04 0:00 /sbin/mingetty tty3
root 3607 0.0 0.0 1748 444 tty4 Ss+ Jul04 0:00 /sbin/mingetty tty4
root 3608 0.0 0.0 1748 444 tty5 Ss+ Jul04 0:00 /sbin/mingetty tty5
root 3609 0.0 0.0 1748 448 tty6 Ss+ Jul04 0:00 /sbin/mingetty tty6
root 11535 0.0 0.5 12796 6192 ? Ss Jul04 0:06 /usr/local/apache/bin/httpd -k start -DSSL
root 18839 0.0 0.5 8888 5628 ? S 18:08 0:00 \_ /usr/bin/perl /usr/local/cpanel/bin/leechprotect
nobody 18840 0.0 0.6 13796 6636 ? S 18:08 0:01 \_ /usr/local/apache/bin/httpd -k start -DSSL
nobody 19676 0.0 0.6 13800 6612 ? S 18:15 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
nobody 20089 0.0 0.6 14428 6860 ? S 18:19 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
hostxnow 24535 0.2 1.4 96376 15484 ? S 19:01 0:00 | \_ /usr/bin/php /home/hostxnow/public_html/forums/showthread.php
nobody 20889 0.0 0.6 13964 6588 ? S 18:26 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
hostxnow 24563 0.0 0.0 6884 124 ? D 19:02 0:00 | \_ /usr/bin/php /home/hostxnow/public_html/support/modules/livehelp/plugins/whmcs/status.php
nobody 22126 0.0 0.6 13796 6564 ? S 18:37 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
hostxnow 24546 0.0 0.0 6884 120 ? D 19:01 0:00 | \_ /usr/bin/php /home/hostxnow/public_html/support/modules/livehelp/xml/WebService.php
nobody 23356 0.0 0.6 13476 6212 ? S 18:49 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
nobody 23539 0.0 0.5 13228 5904 ? S 18:51 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
nobody 24447 0.0 0.5 13200 5512 ? S 19:00 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
nobody 24449 0.0 0.5 13640 6156 ? S 19:00 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
hostxnow 24464 0.0 1.2 93964 13052 ? S 19:01 0:00 | \_ /usr/bin/php /home/hostxnow/public_html/support/modules/livehelp/plugins/whmcs/status.php
nobody 24450 0.0 0.5 13640 6156 ? S 19:00 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
hostxnow 24465 0.0 1.2 93964 13056 ? S 19:01 0:00 | \_ /usr/bin/php /home/hostxnow/public_html/support/modules/livehelp/plugins/whmcs/status.php
nobody 24451 0.0 0.5 13720 6028 ? S 19:00 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
hostxnow 24543 0.0 0.0 6884 124 ? D 19:01 0:00 | \_ /usr/bin/php /home/hostxnow/public_html/support/modules/livehelp/plugins/whmcs/status.php
nobody 24455 0.0 0.5 13336 5672 ? S 19:00 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
hostxnow 24544 0.0 0.0 6884 116 ? D 19:01 0:00 | \_ /usr/bin/php /home/hostxnow/public_html/support/modules/livehelp/xml/WebService.php
nobody 24457 0.0 0.5 13760 6160 ? S 19:00 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
hostxnow 24548 0.0 0.0 6884 124 ? D 19:01 0:00 | \_ /usr/bin/php /home/hostxnow/public_html/support/modules/livehelp/plugins/whmcs/status.php
nobody 24458 0.0 0.5 13336 5680 ? S 19:01 0:00 \_ /usr/local/apache/bin/httpd -k start -DSSL
hostxnow 24564 0.0 0.0 6884 124 ? D 19:02 0:00 \_ /usr/bin/php /home/hostxnow/public_html/index.html
root 11539 0.0 0.1 6000 1372 ? Ss Jul04 0:00 nginx: master process /usr/local/sbin/nginx -c /etc/nginx/nginx.conf
nobody 18837 0.0 0.2 7576 2404 ? S 18:08 0:00 \_ nginx: worker process
nobody 18838 0.0 0.2 7320 2452 ? S 18:08 0:00 \_ nginx: worker process
root 11807 0.0 9.0 125808 93776 ? Ssl Jul04 0:24 /usr/sbin/clamd
mailnull 11832 0.0 0.0 10392 964 ? Ss Jul04 0:00 /usr/sbin/exim -bd -q60m
mailnull 24454 0.0 0.2 10736 2596 ? D 19:00 0:00 \_ /usr/sbin/exim -bd -q60m
root 15138 0.0 0.3 5820 4052 ? S Jul06 0:00 queueprocd - wait to process a task
root 15150 0.0 0.2 5060 2900 ? S Jul06 0:01 tailwatchd
root 24550 0.0 0.2 5144 2876 ? D 19:01 0:00 \_ tailwatchd - chkservd
root 15182 0.0 0.2 4196 2252 ? S Jul06 0:02 cPhulkd - processor
root 24486 0.0 0.4 7824 4472 ? S 19:01 0:00 \_ cPhulkd - processor
root 24487 0.0 0.4 7824 4472 ? S 19:01 0:00 \_ cPhulkd - processor
root 24540 0.0 0.4 7824 4472 ? S 19:01 0:00 \_ cPhulkd - processor
root 24542 0.0 0.4 7824 4472 ? S 19:01 0:00 \_ cPhulkd - processor
root 15194 0.0 0.8 15144 9080 ? S Jul06 0:00 cpdavd - accepting connections on 2077 and 2078
root 15202 0.0 0.2 4212 2188 ? SN Jul06 0:00 cpanellogd - sleeping for logs
root 15253 0.0 0.7 14360 7792 ? S Jul06 0:01 cpsrvd - waiting for connections
root 24484 0.0 0.7 14908 8156 ? S 19:01 0:00 \_ whostmgrd - serving 82.46.201.7
root 24485 0.0 0.7 14592 8160 ? S 19:01 0:00 \_ whostmgrd - serving 82.46.201.7
root 24539 0.0 0.7 14644 8172 ? S 19:01 0:00 \_ whostmgrd - serving 82.46.201.7
root 24541 0.0 0.7 14328 7860 ? S 19:01 0:00 \_ whostmgrd - serving 82.46.201.7
root 13677 0.0 0.0 1748 412 ? S Jul07 0:00 /usr/sbin/courierlogger -pid=/var/spool/authdaemon/pid -facility=mail -start /usr/libexec/courier-authlib/authdaemond
root 13684 0.0 0.0 2092 636 ? S Jul07 0:00 \_ /usr/libexec/courier-authlib/authdaemond
root 13685 0.0 0.0 2092 376 ? S Jul07 0:00 \_ /usr/libexec/courier-authlib/authdaemond
root 14142 0.0 0.2 4680 2896 ? S Jul07 0:08 | \_ /etc/authlib/authProg
root 13686 0.0 0.0 2092 376 ? S Jul07 0:00 \_ /usr/libexec/courier-authlib/authdaemond
root 13904 0.0 0.2 4680 2892 ? S Jul07 0:08 \_ /etc/authlib/authProg
root 13682 0.0 0.0 1748 416 ? S Jul07 0:00 /usr/sbin/courierlogger -pid=/var/run/imapd.pid -start -name=imapd /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=50 -maxperip=30 -nodnslookup -noidentlookup 143 /usr/lib/courier-imap/sbin/imaplogin /usr/lib/courier-imap/bin/imapd Maildir
root 13683 0.0 0.0 1860 548 ? S Jul07 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=50 -maxperip=30 -nodnslookup -noidentlookup 143 /usr/lib/courier-imap/sbin/imaplogin /usr/lib/courier-imap/bin/imapd Maildir
root 13692 0.0 0.0 1748 332 ? S Jul07 0:00 /usr/sbin/courierlogger -pid=/var/run/imapd-ssl.pid -start -name=imapd-ssl /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=50 -maxperip=30 -nodnslookup -noidentlookup 993 /usr/lib/courier-imap/bin/couriertls -server -tcpd /usr/lib/courier-imap/sbin/imaplogin /usr/lib/courier-imap/bin/imapd Maildir
root 13693 0.0 0.0 1860 520 ? S Jul07 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=50 -maxperip=30 -nodnslookup -noidentlookup 993 /usr/lib/courier-imap/bin/couriertls -server -tcpd /usr/lib/courier-imap/sbin/imaplogin /usr/lib/courier-imap/bin/imapd Maildir
root 13698 0.0 0.0 1748 416 ? S Jul07 0:00 /usr/sbin/courierlogger -pid=/var/run/pop3d.pid -start -name=pop3d /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=50 -maxperip=30 -nodnslookup -noidentlookup 110 /usr/lib/courier-imap/sbin/pop3login /usr/lib/courier-imap/bin/pop3d Maildir
root 13699 0.0 0.0 1860 544 ? S Jul07 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=50 -maxperip=30 -nodnslookup -noidentlookup 110 /usr/lib/courier-imap/sbin/pop3login /usr/lib/courier-imap/bin/pop3d Maildir
root 13704 0.0 0.0 1748 416 ? S Jul07 0:00 /usr/sbin/courierlogger -pid=/var/run/pop3d-ssl.pid -start -name=pop3d-ssl /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=50 -maxperip=30 -nodnslookup -noidentlookup 995 /usr/lib/courier-imap/bin/couriertls -server -tcpd /usr/lib/courier-imap/sbin/pop3login /usr/lib/courier-imap/bin/pop3d Maildir
root 13705 0.0 0.0 1860 544 ? S Jul07 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=50 -maxperip=30 -nodnslookup -noidentlookup 995 /usr/lib/courier-imap/bin/couriertls -server -tcpd /usr/lib/courier-imap/sbin/pop3login /usr/lib/courier-imap/bin/pop3d Maildir
root 27178 0.0 0.1 4632 1220 ? S Jul07 0:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --pid-file=/var/lib/mysql/cloud.hostxnow.com.pid
mysql 27245 0.0 2.1 116892 22044 ? Sl Jul07 1:57 \_ /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --log-error=/var/lib/mysql/cloud.hostxnow.com.err --pid-file=/var/lib/mysql/cloud.hostxnow.com.pid
root 24476 0.0 1.3 17772 13648 ? Ss 00:00 0:09 lfd - sleeping
root 24526 0.0 1.2 17772 12716 ? S 19:01 0:00 \_ lfd - checking system integrity
root 24527 0.0 0.0 3820 544 ? D 19:01 0:00 | \_ /usr/bin/md5sum --check /etc/csf/csf.tempint
root 24551 0.0 1.2 17772 12820 ? S 19:01 0:00 \_ lfd - (child) checking load...
root 24559 0.0 0.0 4464 928 ? R 19:02 0:00 \_ /bin/ps axuf