46 lines
1.5 KiB
Plaintext
46 lines
1.5 KiB
Plaintext
These are examples of the results after running the sh_who.d script.
|
|
|
|
This script shows which UIDs and PIDs are running shell scripts, and how
|
|
active they are. It measures the number of lines executed according to
|
|
the line probe - which is a useful, but rough measure of shell activity.
|
|
|
|
Here it runs as a script executes three times.
|
|
|
|
# sh_who.d
|
|
Tracing... Hit Ctrl-C to end.
|
|
^C
|
|
PID UID LINES FILE
|
|
13663 0 9 ./func_abc.sh
|
|
13667 0 9 ./func_abc.sh
|
|
13671 0 9 ./func_abc.sh
|
|
|
|
We see func_abc.sh ran three seperate times, each with nine lines of shell
|
|
activity.
|
|
|
|
|
|
Here we trace an instance of starting Mozilla Firefox.
|
|
|
|
# sh_who.d
|
|
Tracing... Hit Ctrl-C to end.
|
|
^C
|
|
PID UID LINES FILE
|
|
13678 100 1 firefox
|
|
13679 100 1 firefox
|
|
13680 100 1 firefox
|
|
13681 100 1 firefox
|
|
13683 100 1 firefox
|
|
13685 100 1 firefox
|
|
13686 100 1 firefox
|
|
13687 100 1 firefox
|
|
13690 100 1 firefox
|
|
13693 100 1 /usr/lib/firefox/run-mozilla.sh
|
|
13694 100 1 /usr/lib/firefox/run-mozilla.sh
|
|
13695 100 1 /usr/lib/firefox/run-mozilla.sh
|
|
13692 100 55 /usr/lib/firefox/run-mozilla.sh
|
|
13677 100 75 firefox
|
|
|
|
Firefox itself (PID 13677) ran 75 lines of code. There are also instances of
|
|
firefox running a single line of code with a different PID each time. These
|
|
are probably calls to subshells. Use the sh provider to confirm.
|
|
|