0

The box in question is RHEL/CentOS 5.5 x86_64. It has been up for 80+ days.

A custom watchdog script exists on the server which performs a variety of tasks and this particular script accepts a few arguments. When one of my users on the box runs the script with the appropriate arguments, it does what it's supposed to do. However, we've found that sometimes we find a box like this where the script is running automagically and with different arguments.

Question is: based on ps and other research I've found that at 4:02am today it was started. The pid of the process is in the 8000 range, and the parent is 1 or init.

Since the box hasn't been rebooted, how can I find out what called this script and why init is its parent?

2
  • I believe the resolution to this question is that if you have a process whose parent PID is 1 or init, then it is being run automatically somehow. In this case, it seems to be that the process was running because of a script within the /etc/cron.daily directory. Thanks! Aug 21, 2012 at 19:52
  • I've also found that by viewing the /etc/crontab file on the box, it shows that the cron.daily scripts are run at the exact same time as the STIME for the process in question. So /etc/crontab and cron.daily are definitely the culprits for my particular situation. Aug 21, 2012 at 20:02

1 Answer 1

1

Take a look at /proc/PID/loginuid. That should tell you which user started the script, even if they used su or sudo. The majority of services, started from /etc/init.d/ scripts, will have a PPID of 1.

1
  • thank you, I was poking around in /proc a bit ago. The UID of the user for this process is root, or 0. So based on all of this information it seems like it has to be in the sys v init start files somewhere. It's either something in /etc/init.d/ or rc.local or something.... Aug 21, 2012 at 19:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .