Linux Stealth Process

cat /proc/<pid>/environ

If you want to have pid(s) of a given running executable you can, among a number of other possibilities, use pidof:

AlberT$ pidof sshd   
30690 6512 

EDIT:

I totally quote Dennis Williamson and Teddy comments to achieve a more readable output. My solution is the following:

tr '\0' '\n' < /proc/<pid>/environ

You sure there's nothing in the logs?

You could configure Apache's MPM worker to restrict the number of processes it starts/manages.

There is also a little-known DDoS attack which keeps connections alive (HTTP's Keep-Alive mechanism) instead of closing them when it's finished, and this can cause hundreds of additional processes to start as Apache believes it's handling requests from these DDoS processes and generates new ones for new processes.

When you restart Apache, it kills off these rogue processes and hence the connections, so it depends how long it takes for the attacker to realise it's gotten disconnected and try again.

You could also enable the server-status and server-info handlers and watch them when it starts getting busy to identify what the server's doing.

http://httpd.apache.org/docs/2.2/mod/mod_status.html

http://httpd.apache.org/docs/2.2/mod/mod_info.html