topic Re: Find command trace !! in Operating System - HP-UX

Find command trace !!

titu — Mon, 27 Apr 2009 07:17:12 GMT

Hi All ,

In my system top shows some find command initiated by root.

Is there any way we can trace from which terminal or from which ip address this command was been initiated and any auditing feature which we can use to trace ?

Thanks in advance

Titu

Re: Find command trace !!

avizen9 — Mon, 27 Apr 2009 07:25:13 GMT

you can type
ps -ef | grep find
this will show you proccess id and user info

can type who -a which will show you the login information,

Re: Find command trace !!

avizen9 — Mon, 27 Apr 2009 07:27:46 GMT

forgot to write

you can trace out who is running this command by identify terminal info

i.e
ttyp1
ttyp2
ttyp3

Re: Find command trace !!

Ganesan R — Mon, 27 Apr 2009 07:48:44 GMT

Hi,

who -u will list the tty, PID and destination address in which user logged in.

Also use ps -fp to know more details about the process

Re: Find command trace !!

titu — Mon, 27 Apr 2009 08:07:13 GMT

Thanks for all response.

Re: Find command trace !!

Venkatesh BL — Mon, 27 Apr 2009 08:08:40 GMT

It is natural for 'find' to show such spikes for a short duration. It may not be a cause for concern. Looks for other user application that top the list.

Re: Find command trace !!

Dennis Handly — Mon, 27 Apr 2009 11:45:52 GMT

>Is there any way we can trace from which terminal

Since you are the sysadmin, you are running it. Either from a terminal or from cronjob.

You can get the process tree by:
UNIX95=EXTENDED_PS ps -H -fu root