Scenario

You have noticed an unexpected spike in system load. You suspect a batch of recently spawned jobs is responsible and need to isolate processes that started within the last few minutes.

Task

Identify all processes started within the last 10 minutes and save their PID, User, Start Date (lstart), and Command to /home/devops/recent_processes.txt. Once recent processes written to the file Terminate the Suspicious processes (i.e any process that doesn't belong to the root user or systemd).

Example

The file /home/devops/recent_processes.txt should contain the list of recently started processes:

  PID USER     STARTED                     CMD
 8234 deploy   Mon Oct 29 16:37:12 2025    /opt/scripts/deploy.sh
 8235 deploy   Mon Oct 29 16:37:15 2025    bash ./worker_start.sh

Step 1: Filter recent processes by elapsed time

Use ps to display the elapsed time in seconds (etimes) as the first column. Use awk to filter for lines where the time is less than or equal to 600 seconds (10 minutes).Save the details to the required file.

ps -eo pid,user,lstart,cmd --sort=etimes | awk '$1 <= 600 {$1=""; print $0}' > /home/devops/recent_processes.txt

Step 2: Review the file

Check the output for processes that don't belong (e.g., non-system users running unknown scripts).

cat /home/devops/recent_processes.txt

Step 3: Identify suspicious processes

Look for processes running under user accounts (like deploy or appuser) rather than system services.

grep -vE "root|systemd" /home/devops/recent_processes.txt

Step 4: Terminate the suspicious process

Use the PID identified in the previous step.

sudo kill <PID>