Wierd process running

[Robert Brockway]

On Sat, 10 Jan 2004, Madison Kelly wrote:

> 14173 ?        SN     0:00 sh -c ( tail -f??      ????
> /var/log/messages ) 2>&1
> 14174 ?        SN     0:00 tail -f /var/log/messages
>
> It often shows up multiple time and always 1 PID off of each other
> (though the pair may be many PIDs off). I can 'kill -9' it but what the

14173 will be the parent of 14174 in your example.

> heck is doing this? Any ideas? Thanks!

Do a pstree to see where it is coming from.

You may also want to do ps -ef (legal with Linux ps) to see the ppid
(parent pid) of the "sh -c".  This should help in tracking down the
source.

I must admit this is a little surprising since tail -f is normally done by
people wanting to watch a log files over a period of time but the commands
above should shed some light.

Rob

-- 
Robert Brockway
Senior Technical Consultant, OpenTrend Solutions Ltd.
Phone: 416-669-3073, Email: rbrockway-wgAaPJgzrDxH4x6Dk/4f9A at public.gmane.org, http://www.opentrend.net
OpenTrend Solutions: Reliable, secure solutions to real world problems.
--
The Toronto Linux Users Group.      Meetings: http://tlug.ss.org
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml