Processes in the last 24 hrs...

[BIS]

Hello,

I have a small question.

I have a box from which I am pretty certain a process is running once a day that ftp's a file to another server. This is done via some sort of script as I can see nothing in the cron-tab (I have root access).

Is there a command that will show me what processes have run in the last 24 hours so I can nail down the script?

Many thanks in advance.

 

[jad]

that'd do ... hadn't thought of that ...

you need to then pass all the parameters to the moved ftp binary so that ftp commands still work, but they're logged ...

 

[BIS]

this sounds interesting, but a bit too complicated for my humble skills...

could you elaborate?

please?

 

[Annihilannic]

[tt]cd /usr/bin
mv ftp ftp.original
cat > ftp
/usr/proc/bin/ptree $$ > /tmp/ptree.out.$$[/tt]

(then hit Ctrl-D to end the file)

[tt]chmod 755 ftp[/tt]

And then wait until the process has run and have a look in the file(s) generated in /tmp.

Do the following to undo your changes:

[tt]cd /usr/bin
mv ftp.original ftp[/tt]

ptree displays a process' parents and children, so you should be able to establish how it's being called. If you still want the FTP process to actually do it's work, add the following line before the Ctrl-D:

[tt]/usr/bin/ftp.original $*[/tt]
Annihilannic.

 

[jad]

this can be dangerous ... remember to undo it when you've finished.

mv /usr/bin/ftp /usr/bin/ftp.bin

echo "#!/bin/sh
OUTFILE="/tmp/outfile.ptree"

echo >> \$OUTFILE
date "+%H:%M:%S %d/%m/%Y" >> \$OUTFILE
/usr/proc/bin/ptree \$$ >> \$OUTFILE
/usr/bin/ftp.bin \$@" > /usr/bin/ftp

chmod 555 /usr/bin/ftp

cross your fingers, then try ftp'ing somewhere ...

 

[BIS]

nice ,

I'll try it out and let you know.

many thanks

 

[dnormant]

Two other things to consider. Do a find on <.netrc> this is a control file for automating ftp sessions. This could point you at the user that's doing the job.

There could also be a recursive <at> job - maybe started from a /etc/rc?.d script.