how to find out offending user using tty information

Question

I have an script called wow.sh on a shared machine.

'ps -ef | grep wow' shows multiple runs of the same script.

How can I use the tty information to find the offending users ip?

Answer 1

You can try "last", which will show you last logins. So if you narrowed it down to a user, you can run last username and the 3rd column is their login origin.

Answer 2

In the most basic sense, you need to track down who ran it and where they logged in from:

ps axo command,user,lstart | grep [w]ow

The 2nd field gives you the user. If this is obvious (i.e. not 'root' or some shared username) then you can use 'last' as Alex mentions:

ps axo user,command,lstart | grep [w]ow | cut -f1 -d' ' | xargs last -n 1000 -iF

Just match up their date from the first command (the 'lstart' last column) with the login/logout reported by last.

Answer 3

If the offending party will still be logged in (i.e. they're not disown-ing scripts or similar) then who will give you the IP and tty of the logged-in users.