How to detect which process is run by what?

UNIX for Beginners Q & A
1

Hello,
I am running under ubuntu 14.04
Very long time ago, I set a script ( ban.sh ) to block ip addresses abusing my system which was not active.
I have not touched the server over six months or more.
Today, after restart the system, ban.sh started running all of a sudden and keep submitting email to me every 2/3 minutes.
I put # in front of my ban.sh task in crontab -e
/etc/crontab has no rule.
After this change, it keeps sending me emails. Does it require hardware reboot or network restart to make activate the changes or how may I know which process/script is forcing ban.sh to start again?

PS: As a palliative solution, I have ran apt-get autoremove mail*
Thank you
Boris

2

I'm not sure what you're asking here but I think it's about how to stop crontab running a job.

If you use the crontab command to create or cancel or modify a schedule then the crontab daemon should get signalled immediately and modify its behaviour. If you edit the crontab files directly then it could take up to 24 hours to take effect because the crontab daemon doesn't know about the change. To get an immediate effect in this case you would need to issue a command to restart the cron daemon from a root privileged account.

On Ubuntu the cron tables themselves are located at /var/spool/cron/crontabs . There is one file for each user with cron jobs scheduled and you can cat these to see the contents (but, by the book, you shouldn't edit them).

Does that help or have I misunderstood your question?

1 Like
3

Sending me mails?
Who is "me"?

The crontab jobs send mails back to the owner, normally the output of the script (if there was any).

4

Hello MadeInGermany,
root@hostname was submitting email.
I uninstalled some softwares which are not in use anymore and removed messaging softwares like mail,mailx,

Kind regards
Boris

5

Please safe the following script as "/usr/local/bin/ptree", and make it executable.

#!/bin/sh
# Solaris style ptree

[ -x /usr/bin/ptree ] && exec /usr/bin/ptree "$@"

PATH=/bin:/usr/bin:/usr/sbin:/sbin
export PATH

case $1 in
-*)
 echo "
Usage: ptree [ PID | USER ]
Print process tree
 PID : extract branch for this process
 USER : filter for this (existing) user
 USER PID : do both
"
 exit
;;
*[!0-9]*)
 psopt="-u $1"
 shift
;;
*)
 psopt="-e"
esac
psopt="$psopt -H -o pid= -o args="

if [ -z "$1" ]; then
 ps $psopt
 exit
fi

#some effort to add less to the ps list
tmp=/tmp/ptree.$$
trap 'rm -f $tmp' 0 HUP INT TERM
ps $psopt >$tmp
<$tmp awk '
{ ci=index(substr($0,6),$2); o[ci]=$0 }
ci>s[a] { s[++a]=ci }
$1==pid {
 for(i=1;i<=a;i++) {
  si=s; if(si<=ci) print o[si]
 }
 walkdown=ci
 next
}
ci<=walkdown { exit }
walkdown!=0 { print }
' pid="$1"

Then put the following as one of the first commands into your "ban.sh" script:

/usr/local/bin/ptree $$ >>/tmp/ban.sh.ptree.out

Now, in /tmp/ban.sh.ptree.out you can see which processes (and parent processes) ran your "ban.sh".

1 Like