What is calling my executable *.sh script?

Question

A long time ago I copied/modified a script that used inotify to tell me the results of an automatic clamscan when something was downloaded to Downloads - I followed this online resource: https://fitzcarraldoblog.wordpress.com/2017/03/05/using-the-clamav-daemon-to-scan-files-placed-in-my-downloads-directory-in-gentoo-linux/.

My question: How do I find out what is executing this script, called clamscanInotify.sh?

Though the tutorial suggested using crontab, which I did and have since edited out of my crontab -e file, this script is still somehow being executed.

I have checked;

1. my user's crontab,

2. my root's crontab,

3. all the cron.daily/weekly/etc,

4. /etc/cron.d/

and cannot what is executing the script. I've looked in the journal using;

journalctl -b | grep cron

or for when I know the approximate time I downloaded something,

journalctl -b | grep -e "10:00" 

I've also just used grep to search for the string of the name of the executable - clamscanInotify.sh,

sudo grep -rnw / -e "clamscanInotify.sh",

but did not find the string anywhere, not even in /etc/.

I do not have at/atd daemon and I cannot think of what else to do to look for whatever is calling this executable script, clamscanInotify.sh.

It is also not in Linux Mint's "Startup Applications" selection using the GUI for the desktop.

I don't simply want to delete the *.sh file, but my screen and terminals filling up with zenity windows and messages is annoying.

Any ideas of where to look?

PS

Here is a pic of my (h)top;

Answer 1

The slow way would be to use PS: what does "ps -o comm= -p $PPID" do to capture the parent process(es) until you find something interesting.

Since you're using bash in the script, add:

ps -o pid=,comm= -p $PPID

and redirect that to a temporary file. Inspect the contents of that file and then inspect the parent tree; if, for example, that file contains:

8815 bash

then follow up with:

ps -o ppid=,comm= -p 8815

where here we're asking for process 8815's parent pid and command.

With a Linux system, insert pstree -s -p $$ to ask for the ancestry chain for the current process ($$).

At some point you'll end up with your desktop manager or whatever method you used to log in.

It's entirely possible that one of your bash initialization scripts is setting this up; I would borrow this answer, for example and run something like:

bash -ix </dev/null 2>trace

and then search the trace file for the inotify script in question. As the linked answer also says, the best initial guesses are:

• ~/.bash_profile
• ~/.profile
• ~/.bash_login
• /etc/profile
• ~/.bashrc

... in which case you could try:

grep clamscanInotify.sh ~/.bash_profile ~/.profile ~/.bash_login /etc/profile ~/.bashrc