From owner-freebsd-questions@FreeBSD.ORG  Wed Feb 15 20:29:32 2006
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id EFC5D16A420
	for <freebsd-questions@freebsd.org>;
	Wed, 15 Feb 2006 20:29:32 +0000 (GMT)
	(envelope-from techlist@bnetmd.net)
Received: from ns1.bnetmd.net (ns1.BNETMD.NET [216.133.66.171])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 8E42243D53
	for <freebsd-questions@freebsd.org>;
	Wed, 15 Feb 2006 20:29:32 +0000 (GMT)
	(envelope-from techlist@bnetmd.net)
Received: from glenn (c-68-34-37-204.hsd1.md.comcast.net [68.34.37.204])
	by ns1.bnetmd.net (8.13.1/8.13.1) with SMTP id k1FKSl9O045469
	for <freebsd-questions@freebsd.org>;
	Wed, 15 Feb 2006 15:29:01 -0500 (EST)
	(envelope-from techlist@bnetmd.net)
Message-ID: <002601c6326e$da0fd5a0$6601a8c0@bnetmd.net>
From: "Glenn McCalley" <techlist@bnetmd.net>
To: <freebsd-questions@freebsd.org>
References: <005701c63241$dbb3e220$6601a8c0@bnetmd.net>
	<43F3531E.8080205@cs.tu-berlin.de>
Date: Wed, 15 Feb 2006 15:31:46 -0500
Organization: Business.Net LLC
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
Subject: Re: how to tell what ran what
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Glenn McCalley <techlist@bnetmd.net>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Feb 2006 20:29:33 -0000


----- Original Message ----- 
From: "Björn König" <bkoenig@cs.tu-berlin.de>
To: "Glenn McCalley" <techlist@bnetmd.net>
Cc: <freebsd-questions@freebsd.org>
Sent: Wednesday, February 15, 2006 11:13 AM
Subject: Re: how to tell what ran what


> Glenn McCalley schrieb:
>
> > Is there a way to find out -which- -process- calls another process?
>
> Each process is associated with a parent; look at the ppid column:
>
>    ps axo user,pid,ppid,command
>
> Björn
>
>
Thanks, I stated the question poorly.  My fault.
Is historical info available and is it available by file name?

I trying to find out (for example) what (unknown) program ran another
(known) program between 0900 and 1000 yesterday - something like that.

I've got a customer sending our emails that he shouldn't - I don't know
which customer it is.  The program that sends the mail is running as a cgi
so it all shows up as user "nobody".

If I can get a list of what programs, path and file name, called sendmail
over (say) the last 24 hours, one of them should jump off the page with an
unreasonable level of activitiy.

Thanks!
Glenn.