1 These are examples of the results after running the sh_who.d script. 2 3 This script shows which UIDs and PIDs are running shell scripts, and how 4 active they are. It measures the number of lines executed according to 5 the line probe - which is a useful, but rough measure of shell activity. 6 7 Here it runs as a script executes three times. 8 9 # sh_who.d 10 Tracing... Hit Ctrl-C to end. 11 ^C 12 PID UID LINES FILE 13 13663 0 9 ./func_abc.sh 14 13667 0 9 ./func_abc.sh 15 13671 0 9 ./func_abc.sh 16 17 We see func_abc.sh ran three seperate times, each with nine lines of shell 18 activity. 19 20 21 Here we trace an instance of starting Mozilla Firefox. 22 23 # sh_who.d 24 Tracing... Hit Ctrl-C to end. 25 ^C 26 PID UID LINES FILE 27 13678 100 1 firefox 28 13679 100 1 firefox 29 13680 100 1 firefox 30 13681 100 1 firefox 31 13683 100 1 firefox 32 13685 100 1 firefox 33 13686 100 1 firefox 34 13687 100 1 firefox 35 13690 100 1 firefox 36 13693 100 1 /usr/lib/firefox/run-mozilla.sh 37 13694 100 1 /usr/lib/firefox/run-mozilla.sh 38 13695 100 1 /usr/lib/firefox/run-mozilla.sh 39 13692 100 55 /usr/lib/firefox/run-mozilla.sh 40 13677 100 75 firefox 41 42 Firefox itself (PID 13677) ran 75 lines of code. There are also instances of 43 firefox running a single line of code with a different PID each time. These 44 are probably calls to subshells. Use the sh provider to confirm. 45 46
Indexes created Tue Apr 21 00:23:25 UTC 2026