ps -eo rss,pid,user,command --sort -size | \
awk '{ hr=$1/1024 ; printf("%13.2f Mb ",hr) } { for ( x=4 ; x<=NF ; x++ ) { printf("%s ",$x) } print "" }' | \
egrep -v 0.00
One line
ps -eo rss,pid,user,command --sort -size | awk '{ hr=$1/1024 ; printf("%13.2f Mb ",hr) } { for ( x=4 ; x<=NF ; x++ ) { printf("%s ",$x) } print "" }' | egrep -v 0.00
rsync -arvz -e 'ssh -p <port>' --progress SRC DST
// list file with datetime (-l = list only filename)
grep --include=*.php -rl 'eval(' . | xargs ls -lt
// List owner and group is www-data
grep --include=*.php -lr 'eval(' . | xargs ls -lt | grep -E 'www\-data\s+www\-data'
Some pattern can be used: phpinfo
, assert(
, shell_exec(
, system(
, exec(
, popen(
, passthru(
, proc_open(
, pcntl_exec(
for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l; done
Edit if you want to know which user a crontab belongs to, use echo $user
for user in $(cut -f1 -d: /etc/passwd); do echo $user; crontab -u $user -l; done