Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The box in question is RHEL/CentOS 5.5 x86_64. It has been up for 80+ days.

A custom watchdog script exists on the server which performs a variety of tasks and this particular script accepts a few arguments. When one of my users on the box runs the script with the appropriate arguments, it does what it's supposed to do. However, we've found that sometimes we find a box like this where the script is running automagically and with different arguments.

Question is: based on ps and other research I've found that at 4:02am today it was started. The pid of the process is in the 8000 range, and the parent is 1 or init.

Since the box hasn't been rebooted, how can I find out what called this script and why init is its parent?

share|improve this question
    
I believe the resolution to this question is that if you have a process whose parent PID is 1 or init, then it is being run automatically somehow. In this case, it seems to be that the process was running because of a script within the /etc/cron.daily directory. Thanks! –  beaconfield Aug 21 '12 at 19:52
    
I've also found that by viewing the /etc/crontab file on the box, it shows that the cron.daily scripts are run at the exact same time as the STIME for the process in question. So /etc/crontab and cron.daily are definitely the culprits for my particular situation. –  beaconfield Aug 21 '12 at 20:02

1 Answer 1

up vote 1 down vote accepted

Take a look at /proc/PID/loginuid. That should tell you which user started the script, even if they used su or sudo. The majority of services, started from /etc/init.d/ scripts, will have a PPID of 1.

share|improve this answer
    
thank you, I was poking around in /proc a bit ago. The UID of the user for this process is root, or 0. So based on all of this information it seems like it has to be in the sys v init start files somewhere. It's either something in /etc/init.d/ or rc.local or something.... –  beaconfield Aug 21 '12 at 19:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.