Hi all

I got this Fedora release 14 server running. And it has a process somewhere that creates a very large log file every day at 2:30am on the dot.

Let's call it application A. It will create the log file names with following format: A.time_stamp.cfg

and it's always in the same directory: home/userB/appA/

I would like to find this process and shut it off. ps -tree doesn't really help because there are too many unknown processes for me to rule out.

Lsof doesn't help, it shows me nothing for some reason. Even when I vi'ed the file and afterwards I ran lsof I get nothing back.




I would also like to find out where it is running from so I can see the execution script.

Does any have any clues about how I should proceed with this?

Thanks

look in the various folders /etc/crond.* you may find that cron.daily is set to run at 2:30am

Or look in the various users crontabs to see if they have anything scheduled to run at 2:30am.

The crontab of the "owner" of the created file may be a good start point.

@jzoudavy I'm guessing lsof only showed you files for the user that you ran it *as*. To see all files run it as root, you probably want to try something like:

lsof | grep "suspectusernamehere"

Further to TenTenth's good suggestions, depending on your distro you might find private cron entries in /var/spool/cron/(usernames)

1 members found this post helpful.

hey guys

thanks for your help. I found the script that seems to be getting executed, but the weird thing is that it is not in any of the cron jobs. But fortunately the guy who wrote it signed it so I will talk to him and find more.

Thanks for the help