Tring to locate a script

Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users Tring to locate a script
# 1  
Old 09-18-2013
Linux Tring to locate a script

We have a process on our Linux RedHat machine creating symbolic links and moving around some files from domain to domain. The issue is that the programmer has left a long time ago and nobody knows how the program is called, where it is and how the scheduling is setup. It runs every day for sure. I've been trying to find out for hours now, we have no documentation nor notes or emails left after all these years and I really need to change the script. I know it exists for a fact.

All links are created using the root user so I looked up all crontab entries for root but I couldn't find anything relevant. We do have autosys installed as well and there also I couldn't find anything helping my search. I checked the applications installed on the machine since they are running their own servers and scheduled processes (scripts can be kicked off this way) but Im fairly convinced its all on the Linux side, knowing the developer was an expert shell programmer.

To make things easier, our OS support (Im from the applicatin side although with privileged access) say that they cannot help us.

Does any of you have the slightest idea about what I could check because Ive run out of ideas. Are all crontab entries supposed to be stored in the /var/spool/cron against the user? I checked anacron and at as well. As for autosys we have all the jobs listed and I checked that none of the scripts were calling external programs.

I'm stuck with this crap, is any of you aware of any other ways to find out that kind of information?

Thanks by advance
# 2  
Old 09-18-2013
What are the domains you are talking about?
Do you use any other scheduler?
I dont know for RH (I have no box anymore...) but sure if I had such issue I would check all the files that have connection logged and see if I could find anything at that specific time
# 3  
Old 09-18-2013
Have you tried enabling auditing? It's usually installed by default on Red Hat, just needs to be configured and enabled. There are plenty of tutorials online on how to set it up.

Alternatively you could install an app such as either TripWire or Splunk to monitor filesystem changes. I believe both have open source versions if you go that route.
# 4  
Old 09-19-2013
We don't use any other scheduler that I know of. About domains, I meant filesets. We call them "domains" hence my initial formulation.

I looked into auditing and such, we have no auditing rules currently on the machine but it's enabled. Before proceeding though I'd like to try to assess if it's really worth a go mainly because my OS maintenance team won't do it for me; after all I already know the user id (root) and what time. Im afraid auditing will just tell me that it was this user at that specific time using a "ln" command (to create links), which is not a stellar amount of information compared to what I already know.

I got our best expert into this now and he wasn't able to find the program either. Im looking at the possibility of a program executed from another machine, even though I still can't find any scheduled entry for anything relevant. We have backup processes between machines so Im looking into this, but still can't find anything.

A question though: since we are talking about different file sets, my knowledge is pretty limited at that level but is there any way two file sets could be setup to "mirror" each other to some extent, so that files and/or links could theoritically spawn on one end without any program or script being involved to go through all amendments every day? Since we can't find said "script" anywhere I start to wonder if such question can be legitimate, e.g. that something else than a script is doing this operation. Only thing is, the file creation happens at a very specific time so that kind of clashes with the idea of having files spawn as they are created. I don't think it makes sense but who knows.

Thanks for the replies so far
# 5  
Old 09-19-2013
It could be a long running process that is loaded at boot time.
# 6  
Old 09-19-2013
Enabling Process Accounting (psacct) may also help find the script and/or program performing the process. Once it's installed and enabled you can use the lastcomm command to list every command being run by every user or narrow it down to a specific user. What is nice is if the process is a script it shows all the commands that the script runs in addition to the script's name.


ln -sf /root/testfile /tmp/testfile


lastcomm --user root | head          root     pts/14     0.00 secs Thu Sep 19 09:17
ln                         root     pts/14     0.00 secs Thu Sep 19 09:17

# 7  
Old 09-19-2013
Thanks, Ill use that and check the logs tomorrow (process runs at 05:30), alt on monday if it can give me the name of the process. Awesome idea. ll let you know if it gave me the answer Im looking for. Just hoping having process auditing enabled won't eat up too much CPU on the machine.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Bash Script Locate Word Failed

I'm using CentOS 7 and I would like to know of a way to read each line and search for a specific word. For example, if it finds the word "Fail" it sends it to a variable, and pipes it to a folder on the network. What would be the best way in making this work in a Linux environment? I wrote a... (1 Reply)
Discussion started by: SysAdminRialto
1 Replies

2. Shell Programming and Scripting

Script to locate date in filename

I am looking for a way to find a date in the file without using find. for example something like this: files=`ls |grep txt` YEST=`TZ="GMT+24" date +'%m-%d-%Y'|sed 's/^0//g' |sed 's/$/.txt/g'` YES1=`TZ="GMT+48" date +'%m-%d-%Y'|sed 's/^0//g' |sed 's/$/.txt/g'` if ]; then echo yes;else echo... (4 Replies)
Discussion started by: newbie2010
4 Replies

3. Red Hat

Can't locate in @INC

my os details as follow bash-3.2$ cat /etc/redhat-release Red Hat Enterprise Linux Server release 5.8 (Tikanga) I run the following and encounter the following error bash-3.2$ mysqlhotcopy -? Can't locate in @INC (@INC contains:... (5 Replies)
Discussion started by: jediwannabe
5 Replies

4. Shell Programming and Scripting

Script to locate Thunderbird message filter

#!/bin/sh #Finds the directory where usually the message folder information is for Thunderbird. clear cd ~/ cd .thunderbird dir=$(dir) echo $dir echo "What is the name of your .default directory?" read userinput echo "Your Thunderbird Message Filter msgFilterRules.dat files are in the... (1 Reply)
Discussion started by: edcompsci
1 Replies

5. AIX

Locate command

Hello to all, Can I use the "locate" command on AIX 5.3 like on Linux. If yes what packages should I install and where can I find them. Thanks, Enid (9 Replies)
Discussion started by: enux
9 Replies

6. UNIX for Dummies Questions & Answers

Problem tring to enable smtp service

People I'm trying to enable de smtp services of a solaris 10 and i get this sendmail: daemon MTA-v4: problem creating SMTP socket sendmail: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA-v4: server SMTP socket wedged: exiting Anyone Knows what is bad? Thank for your time ... (1 Reply)
Discussion started by: enkei17
1 Replies

7. Shell Programming and Scripting

Appending same tring to multiple files in one line?

I have a string that I need to append to 3 files. Say, $ echo "Hello" I want to append this Hello to three files, file1, file2 and file3.The files are all in different directories and the file names have no common pattern.Can I do it in one line? If yes, how? :confused: (2 Replies)
Discussion started by: zombiezparadize
2 Replies

8. UNIX for Dummies Questions & Answers

command locate.

Hi, I am aware of the command locate/slocate. But when I try to search the file which is located in /tmp. Its not able to get it. I tried by updating the database also with the command updatedb. Is there any consern that the command 'locate' dont check /tmp??? And I knew that locate is the... (5 Replies)
Discussion started by: praveen_b744
5 Replies

9. Shell Programming and Scripting

script to locate servers

I am a newbie in shell scripting and I need to produce a script to work and achieve the following: 1) Look into the file /etc/defaultrouter , and store the value in it 2) If the value is a number, go to LIST and print out the second column corresponding to the value.(eg London) 3) If the... (5 Replies)
Discussion started by: ibroxy
5 Replies

10. UNIX for Dummies Questions & Answers

Howto locate locally installed Perl module for a CGI script in APACHE .htaccess

Hi, I have the following simple CGI script, just containg header: #!/usr/bin/perl -w use CGI ':standard'; use lib "/home/myname/lib/perl5/site_perl/5.8.5/"; use Mail::Sendmail; I also have included this directive in ~/public_html/.htaccess : SetEnv PERL5LIB... (0 Replies)
Discussion started by: monkfan
0 Replies
Login or Register to Ask a Question