I would recommend grepping all your http access logs for the timestamp Sep 30 00:33 and seeing what pages were called. That might lead to some clues. On Thu, 2009-10-01 at 18:59 +0200, Dominick Grift wrote: > > > >> exe="/usr/bin/uptime" subj=user_u:system_r:httpd_t:s0