Need to find out whcih script uses su to root

[unixnewbie]

Hi,

My DBA uses a script that will do a su to the DBA user ID from root login and send him some reports by email. This is scheduled by cron. He is not sure which script does that but for the last some days he is not receiving that. There are a lot of crontab entries and it will take a lot of time to analyse each script and find out the exact one. I checked in the /var/adm/sulog file also and cannot find an entry that says "root-orcdba".
Now my request is, could anybody of you suggest me a way to find the scripts that do an su from root to my DBA ID (orcdba). Can we use find command to do this? I believe that most of the scripts DBA use resides in root file system.

Thanks in advance

unixnewbie

[Patrick Wallek]

If the scripts are in fact all in the same directory, then you could do something like this (assuming all scripts end in '.sh':

# grep "su - orcdba" *.sh

[unixnewbie]

Thanks Patrick for that quick response.

There are lot of scripts in different directories.
I tired
find / -name *.sh -exec grep "/usr/bin/su" '{}' \; -print

but got the following error

find: missing conjunction

[Steven Schweda]

> I tired
> find / -name *.sh -exec grep "/usr/bin/su" '{}' \; -print

Yes, it looks exhausted.

find / -name '*.sh' -exec grep '/usr/bin/su' {} \; -print

Quote the stuff which needs quotation, leave
the stuff which needs none.

[Dennis Handly]

If you want the find to be faster use +:
find / -name "*.sh" -exec grep -e /usr/bin/su -e su +

Are you sure the script will have the full path instead of just "su"?

[Michael Steele_2]

Hi

Check the mail.log the root and dba mail boxes for errors.

/var/adm/syslog/mail.log
/var/mail

[T. M. Louah]

1. Not all scripts end with "*.sh"
2. Command "crontab -l" should list all jobs called by cron, u mau c useful output with:
# crontab -l |awk '{ print $6 }'
3. find command may miss some hits try different syntax see which one nail it down:
# find / -type f -exec grep -l "su" {} \;
In above example, we check all Regular files looking for "su" but for more granularity replace it with actual path like "/usr/bin/su".

HTH/T#

[Viktor Balogh]

you can search in all the crontabs like this:

# grep -e su ../crontab.root *