From owner-freebsd-questions@FreeBSD.ORG Thu Feb 16 02:32:21 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9DBCD16A422 for ; Thu, 16 Feb 2006 02:32:21 +0000 (GMT) (envelope-from tim@tetro.net) Received: from uts.tetro.net (uts.tetro.net [192.83.249.35]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3B6DB43D49 for ; Thu, 16 Feb 2006 02:32:21 +0000 (GMT) (envelope-from tim@tetro.net) Received: from tim by uts.tetro.net with local (Exim 4.50) id 1F9YwR-0003rt-Ci; Wed, 15 Feb 2006 18:32:23 -0800 Date: Wed, 15 Feb 2006 18:32:23 -0800 To: Glenn McCalley Message-ID: <20060216023223.GA14425@tetro.net> References: <005701c63241$dbb3e220$6601a8c0@bnetmd.net> <43F3531E.8080205@cs.tu-berlin.de> <002601c6326e$da0fd5a0$6601a8c0@bnetmd.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <002601c6326e$da0fd5a0$6601a8c0@bnetmd.net> User-Agent: Mutt/1.5.9i From: Tim Utschig Cc: freebsd-questions@freebsd.org Subject: Re: how to tell what ran what X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Feb 2006 02:32:22 -0000 On Wed, Feb 15, 2006 at 03:31:46PM -0500, Glenn McCalley wrote: > If I can get a list of what programs, path and file name, called > sendmail over (say) the last 24 hours, one of them should jump off the > page with an unreasonable level of activitiy. A dirty hack would be to replace the sendmail binary with a script (or program) which records info about the parent process to some world- writable file or directory (perhaps create a unique file under a dir with perms 1773 owned by root:staff) before exec'ing the "real" sendmail binary. -- - Tim Utschig