Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to figure out which "script" (really it's probably an "*rc" file) is running a particular command when I reboot my ubuntu machine. I've tried grepping for what is being displayed when I log into the machine after a reboot but I haven't been able to find it.

I know that, for example, the .bash_profile is "sourced" when I log in but what others are run This will help me track down the script/file that's running an old set of commands that I need to update.

Thanks!

here's what happens when i log in:

bos-mp2o6:~ user$ ssh -A X.X.X.X
user@X.X.X.X's password: 
Linux bos-lpwy9 2.6.32-54-generic #116-Ubuntu SMP Tue Nov 12 19:23:22 UTC 2013 x86_64 GNU/Linux
Ubuntu 10.04.4 LTS

Welcome to Ubuntu!
 * Documentation:  https://help.ubuntu.com/

New release 'precise' available.
Run 'do-release-upgrade' to upgrade to it.

Last login: Tue Dec 31 10:53:25 2013 from 172.19.43.138
Agent pid 2117
/home/user/.ssh/internal/2013-07-29: No such file or directory
/home/user/.ssh/deployed/2013-07-29: No such file or directory
Identity added: /home/user/.ssh/external/2013-07-29 (/home/user/.ssh/external/2013-07-29)

if you notice the "Identity added" piece, that's the bit I'm looking for. So I've used the following command (with no luck):

[user@Linux_Desktop:~]$grep_bash 2013-07-29
[user@Linux_Desktop:~]$
share|improve this question

3 Answers 3

up vote 3 down vote accepted

This will depend on many things. I am guessing that you don't actually want the files run when the machine reboots (there are MANY) but those run by your shell (e.g. bash) when you log in or open a terminal.

The easiest way to find the relevant command would be to grep through all possible shell startup files, both for login and interactive shells. I have the following function defined in my $HOME/.bashrc:

grep_bash(){
  for f in  ~/.bashrc ~/.profile ~/.bash_profile ~/.bash_login \
        /etc/profile /etc/bash.bashrc /etc/environment; 
  do 
    [ -e $f ] && grep -H "$@" $f; 
  done
}

I can then use it to search those files for a string of interest:

$ grep_bash foo
/home/terdon/.bashrc:echo foo

The actual files being read depend on the kind of shell you are running. These are the relevant sections from man bash:

   When  bash is invoked as an interactive login shell, or as a non-inter‐
   active shell with the --login option, it first reads and executes  com‐
   mands  from  the file /etc/profile, if that file exists.  After reading
   that file, it looks for ~/.bash_profile, ~/.bash_login, and ~/.profile,
   in  that order, and reads and executes commands from the first one that
   exists and is readable. 

   When an interactive shell that is not a login shell  is  started,  bash
   reads  and  executes  commands  from /etc/bash.bashrc and ~/.bashrc, if
   these files exist.  This may be inhibited by using the  --norc  option.
   The  --rcfile  file option will force bash to read and execute commands
   from file instead of /etc/bash.bashrc and ~/.bashrc.

In most *nix (the only exception I know of is OSX) the default shell when you open a new terminal is an interactive, non-login shell so ~/.bashrc and company are read.

Finally, you also have /etc/environment which is used to set global environment variables and which should be read by most shells.


After discussion with the OP in chat, @derobert helped us figure out that the issue here was caused by /etc/ssh/sshrc.

share|improve this answer
    
which shell (interactive or non-interactive) am I using when I ssh into my ubuntu machine from a MacOSX machine? –  Ramy Dec 31 '13 at 16:32
    
@Ramy if you ssh in, you're using an interactive, login shell, so you need to check ~/.profile, ~/.bash_login, ~/.bash_profile and /etc/profile. –  terdon Dec 31 '13 at 16:33
    
great. and - sorry - but what is cc2ter in your answer? When I pipe to that I get a 'command not found' message. –  Ramy Dec 31 '13 at 16:35
    
@Ramy argh, sorry, should have deleted that. Never mind, it is just a trick I use to change my actual username to terdon for posting answers here :). Also make sure to use the edited version of the function, I had something that was left over from a previous version. The one there now should work. –  terdon Dec 31 '13 at 16:37
    
Thank you so much for the thorough answer, Terdon. Would you mind revisiting my updated question? your f(x) isn't working for me. Maybe my assumptions were wrong? –  Ramy Dec 31 '13 at 16:46

“Agent pid” is from starting ssh-agent, and “Identity added” is from running ssh-add to load keys into the agent. The bit in the middle is probably a custom script.

If your login shell is bash (the default), it loads the first of the following files that exists: ~/.bash_profile, ~/.bash_login, ~/.profile. Check which one it loads and add set -x at the top, then log in again or run bash --login. This tells bash to print a trace of every command it executes. Look for these messages in the trace, this should tell you what's printing them.

If the messages come before the first trace, then they may be from a global initialization file: /etc/profile, or scripts in /etc/profile.d (or scripts that they call).

If the message isn't shown when you run bash --login, then it comes from something started by the SSH daemon and not from the shell. Check if you've added something unusual to the PAM stack: /etc/pam.d/sshd or the /etc/pam.d/common-* files. If it only happens when you log in with SSH, it could be a command in ~/.ssh/rc or /etc/ssh/sshrc on the server. If it only happens when you log in with a particular SSH key, it could be a command associated with the key in ~/.ssh/authorized_keys on the server.

share|improve this answer
    
@terdon Yes. There are probably enough hints around to try and do it the smart way, like you and Gilles. Yet sometimes it is useful to remind oneself the syntax to just solve the problem. –  MariusMatutiae Dec 31 '13 at 17:41

A simpler solution is to use the find, grep and file commands, combined this way:

  find / -type f -mount -exec sh -c ' file "{}" | grep text 1>/dev/null && grep -l "2013-07-29" "{}" ' \;

First, you find all files, and pass the name of each one to a shell which will first test its filetype and, if found to be of the text type, will try to locate the string 2013-07-29 inside it, spitting out the file name if and only (the option -l) is found.

It's going to be a slow business, go get yourself some coffee in the meantime.

share|improve this answer
    
The brute force approach huh? :), +1. –  terdon Dec 31 '13 at 17:37
    
There's a chance that the date is automatically generated from something, though, such as a file name, which your command wouldn't find. Also your command may take forever depending on what's mounted, I highly recommend searching only in /etc and ~ and with -xdev to avoid going into places like ~/.gvfs. –  Gilles Dec 31 '13 at 17:46
    
@Gilles I prefer -mount to -xdev, in case he has an older version of find. But thank you anyway. As for the date, this is what the OP was searching for, see his last lines, not me. ;-) –  MariusMatutiae Dec 31 '13 at 17:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.