I considered that (using the access log), but i needed to identify which PID was the culprit, as there could be many instances of index.cgi running at the same time.