Re: finding how a process got started

EdStevens <quetico_..._at_yahoo.com> wrote:
>
> Platform: Oracle 10.2.0.2.0 on HP-UX B.11.11
>
> Posting to comp.unix.admin, comp.databases.oracle.server

When on topic, it is better to cross-post than to multi-post.

> Chasing the lineage of the pids, I was able to construct this chain:
>
> root 985 1 0 Jun 21 ? 40:08 /opt/ssh/sbin/sshd
> root 2789 985 0 07:38:44 ? 0:00 sshd: oracle_at_notty
> <snip several children of 985>
> root 2792 985 0 07:38:44 ? 0:00 sshd: oracle_at_notty
> oracle 2803 2792 0 07:38:45 ? 0:00 sh -c LC_ALL=C;export
> LC_ALL;vmstat 15
> oracle 2808 2803 0 07:38:45 ? 0:00 vmstat 15
>
> Of interest are the first entry and the last three ... pids 1, 985,
> 2792, 2803, and 2808.
>
> I took this to our SA, hoping he could tell me where 985 came from and
> how it came to spawn 2792, but he hadn't a clue.

A process with parent one is a process that is running nohup. Sone of those are started at boot time - Notice the date of the running ssh daemon.

Look in /etc/inittab for what scripts it runs. Look in /sbin/init.d for scripts that launch sshd at boot time. Look in /sbin/rc*.d for symbolic links to the laucn script you found.

I do not think finding the launch point for sshd is going to show you why your commands are now all aliases or whatever. Look to the dot files in oracle's home dir for recent changes for that. Received on Tue Aug 14 2007 - 11:42:20 CDT