Shell script ran on multiuser environment - linux

Question

I have a linux server and there contains an important script xyz.sh. At times there will be 10-50 users logged into that machine. Is it possible to find who is running the script? Also, is it possible to get a log who all have ran the script xyz.sh; means is it possible to extract a history of script run?

Answer 1

For a simple on-the-fly check about the owners' script while it's runnging you can use:
$ ps -e -o euid,pid,euser,state,command | grep "xyz.sh"|grep -v grep
0 31096 root S /bin/bash ./xyz.sh
1000 31030 ale S /bin/bash ./xyz.sh
It should be possible to log the ps output with this script:
#!/bin/bash
SECONDS=5
TARGET=xyz.sh
OUT=/var/tmp/xyz_history.log
while true
do
sleep $SECONDS
echo "$(date '+TIME:%H:%M:%S';ps -e -opid,user,command|grep $TARGET | grep -v grep)"
done >> $OUT
exit 0
The output:
$ tail -f /var/tmp/xyz_history.log
TIME:14:13:37
496 postgres /bin/bash ./xyz.sh
625 ale /bin/bash ./xyz.sh
32137 root /bin/bash ./xyz.sh
TIME:14:13:38
496 postgres /bin/bash ./xyz.sh
625 ale /bin/bash ./xyz.sh
32137 root /bin/bash ./xyz.sh
TIME:14:13:39
496 postgres /bin/bash ./xyz.sh
625 ale /bin/bash ./xyz.sh
TIME:14:13:40
496 postgres /bin/bash ./xyz.sh
625 ale /bin/bash ./xyz.sh
...
This is not a clean solution of course. If you can install packages on the system and run commands as superuser, a better solution is using lastcomm:
# lastcomm xyz.sh
xyz.sh X ale pts/1 0.00 secs Fri Sep 11 14:12
xyz.sh X root pts/3 0.00 secs Fri Sep 11 14:00
xyz.sh X ale pts/4 0.00 secs Fri Sep 11 14:08
xyz.sh X ale pts/4 0.00 secs Fri Sep 11 14:00
xyz.sh X root pts/4 0.00 secs Fri Sep 11 13:54
xyz.sh X ale pts/1 0.00 secs Fri Sep 11 13:51
xyz.sh X root pts/3 0.00 secs Fri Sep 11 13:42
xyz.sh X ale pts/1 0.00 secs Fri Sep 11 13:36
xyz.sh X ale pts/1 0.00 secs Fri Sep 11 13:36
xyz.sh X ale pts/1 0.00 secs Fri Sep 11 13:36
xyz.sh X ale pts/1 0.00 secs Fri Sep 11 13:36
xyz.sh X postgres pts/1 0.00 secs Fri Sep 11 13:36
xyz.sh X ale pts/1 0.00 secs Fri Sep 11 13:36
xyz.sh X root pts/1 0.00 secs Fri Sep 11 13:36
xyz.sh X ale pts/1 0.00 secs Fri Sep 11 13:36
It's possible install the command lastcomm from the psacct (centos/redhat) or acct package (debian/ubuntu/OpenSuse).