The box in question is RHEL/CentOS 5.5 x86_64. It has been up for 80+ days.
A custom watchdog script exists on the server which performs a variety of tasks and this particular script accepts a few arguments. When one of my users on the box runs the script with the appropriate arguments, it does what it's supposed to do. However, we've found that sometimes we find a box like this where the script is running automagically and with different arguments.
Question is: based on ps and other research I've found that at 4:02am today it was started. The pid of the process is in the 8000 range, and the parent is 1 or init.
Since the box hasn't been rebooted, how can I find out what called this script and why init is its parent?
/etc/crontab
file on the box, it shows that the cron.daily scripts are run at the exact same time as the STIME for the process in question. So/etc/crontab
and cron.daily are definitely the culprits for my particular situation.