I'm trying to figure out which "script" (really it's probably an "*rc" file) is running a particular command when I reboot my ubuntu machine. I've tried grepping for what is being displayed when I log into the machine after a reboot but I haven't been able to find it.

I know that, for example, the .bash_profile is "sourced" when I log in but what others are run This will help me track down the script/file that's running an old set of commands that I need to update.


here's what happens when i log in:

bos-mp2o6:~ user$ ssh -A X.X.X.X
[email protected]'s password: 
Linux bos-lpwy9 2.6.32-54-generic #116-Ubuntu SMP Tue Nov 12 19:23:22 UTC 2013 x86_64 GNU/Linux
Ubuntu 10.04.4 LTS

Welcome to Ubuntu!
 * Documentation:  https://help.ubuntu.com/

New release 'precise' available.
Run 'do-release-upgrade' to upgrade to it.

Last login: Tue Dec 31 10:53:25 2013 from
Agent pid 2117
/home/user/.ssh/internal/2013-07-29: No such file or directory
/home/user/.ssh/deployed/2013-07-29: No such file or directory
Identity added: /home/user/.ssh/external/2013-07-29 (/home/user/.ssh/external/2013-07-29)

if you notice the "Identity added" piece, that's the bit I'm looking for. So I've used the following command (with no luck):

[user@Linux_Desktop:~]$grep_bash 2013-07-29

3 Answers 3


This will depend on many things. I am guessing that you don't actually want the files run when the machine reboots (there are MANY) but those run by your shell (e.g. bash) when you log in or open a terminal.

The easiest way to find the relevant command would be to grep through all possible shell startup files, both for login and interactive shells. I have the following function defined in my $HOME/.bashrc:

  for f in  ~/.bashrc ~/.profile ~/.bash_profile ~/.bash_login \
        /etc/profile /etc/bash.bashrc /etc/environment; 
    [ -e $f ] && grep -H "$@" $f; 

I can then use it to search those files for a string of interest:

$ grep_bash foo
/home/terdon/.bashrc:echo foo

The actual files being read depend on the kind of shell you are running. These are the relevant sections from man bash:

   When  bash is invoked as an interactive login shell, or as a non-inter‐
   active shell with the --login option, it first reads and executes  com‐
   mands  from  the file /etc/profile, if that file exists.  After reading
   that file, it looks for ~/.bash_profile, ~/.bash_login, and ~/.profile,
   in  that order, and reads and executes commands from the first one that
   exists and is readable. 

   When an interactive shell that is not a login shell  is  started,  bash
   reads  and  executes  commands  from /etc/bash.bashrc and ~/.bashrc, if
   these files exist.  This may be inhibited by using the  --norc  option.
   The  --rcfile  file option will force bash to read and execute commands
   from file instead of /etc/bash.bashrc and ~/.bashrc.

In most *nix (the only exception I know of is OSX) the default shell when you open a new terminal is an interactive, non-login shell so ~/.bashrc and company are read.

Finally, you also have /etc/environment which is used to set global environment variables and which should be read by most shells.

After discussion with the OP in chat, @derobert helped us figure out that the issue here was caused by /etc/ssh/sshrc.

  • which shell (interactive or non-interactive) am I using when I ssh into my ubuntu machine from a MacOSX machine?
    – Ramy
    Dec 31, 2013 at 16:32
  • @Ramy if you ssh in, you're using an interactive, login shell, so you need to check ~/.profile, ~/.bash_login, ~/.bash_profile and /etc/profile.
    – terdon
    Dec 31, 2013 at 16:33
  • great. and - sorry - but what is cc2ter in your answer? When I pipe to that I get a 'command not found' message.
    – Ramy
    Dec 31, 2013 at 16:35
  • @Ramy argh, sorry, should have deleted that. Never mind, it is just a trick I use to change my actual username to terdon for posting answers here :). Also make sure to use the edited version of the function, I had something that was left over from a previous version. The one there now should work.
    – terdon
    Dec 31, 2013 at 16:37
  • Thank you so much for the thorough answer, Terdon. Would you mind revisiting my updated question? your f(x) isn't working for me. Maybe my assumptions were wrong?
    – Ramy
    Dec 31, 2013 at 16:46

“Agent pid” is from starting ssh-agent, and “Identity added” is from running ssh-add to load keys into the agent. The bit in the middle is probably a custom script.

If your login shell is bash (the default), it loads the first of the following files that exists: ~/.bash_profile, ~/.bash_login, ~/.profile. Check which one it loads and add set -x at the top, then log in again or run bash --login. This tells bash to print a trace of every command it executes. Look for these messages in the trace, this should tell you what's printing them.

If the messages come before the first trace, then they may be from a global initialization file: /etc/profile, or scripts in /etc/profile.d (or scripts that they call).

If the message isn't shown when you run bash --login, then it comes from something started by the SSH daemon and not from the shell. Check if you've added something unusual to the PAM stack: /etc/pam.d/sshd or the /etc/pam.d/common-* files. If it only happens when you log in with SSH, it could be a command in ~/.ssh/rc or /etc/ssh/sshrc on the server. If it only happens when you log in with a particular SSH key, it could be a command associated with the key in ~/.ssh/authorized_keys on the server.

  • @terdon Yes. There are probably enough hints around to try and do it the smart way, like you and Gilles. Yet sometimes it is useful to remind oneself the syntax to just solve the problem. Dec 31, 2013 at 17:41

A simpler solution is to use the find, grep and file commands, combined this way:

  find / -type f -mount -exec sh -c ' file "{}" | grep text 1>/dev/null && grep -l "2013-07-29" "{}" ' \;

First, you find all files, and pass the name of each one to a shell which will first test its filetype and, if found to be of the text type, will try to locate the string 2013-07-29 inside it, spitting out the file name if and only (the option -l) is found.

It's going to be a slow business, go get yourself some coffee in the meantime.

  • The brute force approach huh? :), +1.
    – terdon
    Dec 31, 2013 at 17:37
  • There's a chance that the date is automatically generated from something, though, such as a file name, which your command wouldn't find. Also your command may take forever depending on what's mounted, I highly recommend searching only in /etc and ~ and with -xdev to avoid going into places like ~/.gvfs. Dec 31, 2013 at 17:46
  • @Gilles I prefer -mount to -xdev, in case he has an older version of find. But thank you anyway. As for the date, this is what the OP was searching for, see his last lines, not me. ;-) Dec 31, 2013 at 17:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .