I just inherited an older Linux server. I am getting asked to identify and stop a process initiated by a user. How can I go about identifying what process a user is executing that matches the logs seen on a remote machine?
Local machine = 10.0.0.2
Remote machine = 10.0.0.3
Remote log - "10.0.0.2 - OS User "fred" is using foo account "service_account" to try and connect to 10.0.0.3.
Your error is very unspecific, it could be caused by lots of different things, most of them not nefarious. Something trying to mount a directory with expired credentials is a big thing for old systems. Especially if the service is using an individual's credential and not a service specific hash.
There are several things you need to know to track that down. The most important is the time. Hopefully all of the systems use the same time source, if not your problem just became harder. Get all of the hosts on the same time server, then start comparing logs. If this is a windows domain that would be the domain controller. Read up on NTPd.
Dig into the specifics of the error in the log you see. It should say what was being attempted beyond credential failure.
Once you know what the time this is occurring after the time is synced, you need to look at logs on the system generating the request. If that is the linux host you want to look at, \var\log\messages (where console errors go), last, history (if you think it may be interactive for a particular user), ps -e (if it happens at a particular time you may see it attempt to run), \etc\crontab for all of the users, or most likely a service config (smb, nfs) that may be trying to make backups. You don't want to discover that an important system is not being backed up after it fails. Expect to do a lot of reading in man pages.
This is one of those things that should be tracked down, simply so you can document the process that is executing it, determine if it is still useful and not working, or not useful and should be stopped.
