4

I have a complex embedded Linux software running on a gentoo derivative, on which a certain piece of code gets executed regularly every ~84 minutes. Sweeping through the main code to find places where this code might get executed was unsuccessful, and crontab also seems no possible explanation.

My question: Is it possible, by modifying the code in question, to find out which other process/code/file/service started it in the first place? Are there some information in the /proc directory I can use? Or is it impossible to find out the process that executed the given code?

2 Answers 2

3

Chris' answer would work if the process is long-lived, and you have time to go inspect it, but if it's a short running command, it may be difficult to catch it while the process is still alive.

Another way you could approach this is to put a 'wrapper' around the program.

Lets say the program being called is /usr/bin/someprog.

  • Move /usr/bin/someprog to /usr/bin/someprog.orig.
  • Create /usr/bin/someprog as a script such as:

 

#!/bin/sh
echo "My pid: $$" >> /tmp/someprog.log
ps -ef --forest >> /tmp/someprog.log
exec /usr/bin/someprog.orig
  • And then chmod a+x /usr/bin/someprog

This will dump a process tree and put it in /tmp/someprog.log. You could then look at the tree and find what is spawning it.

3

It sounds like you're looking for the parent PID (PPID):

$ ps -o ppid -p 5743
 PPID
  219

Since you also mentioned that you have /proc:

$ awk '{ print $4 }' /proc/5743/stat
219
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .