1 1.1 christos These are examples of the results after running the sh_who.d script. 2 1.1 christos 3 1.1 christos This script shows which UIDs and PIDs are running shell scripts, and how 4 1.1 christos active they are. It measures the number of lines executed according to 5 1.1 christos the line probe - which is a useful, but rough measure of shell activity. 6 1.1 christos 7 1.1 christos Here it runs as a script executes three times. 8 1.1 christos 9 1.1 christos # sh_who.d 10 1.1 christos Tracing... Hit Ctrl-C to end. 11 1.1 christos ^C 12 1.1 christos PID UID LINES FILE 13 1.1 christos 13663 0 9 ./func_abc.sh 14 1.1 christos 13667 0 9 ./func_abc.sh 15 1.1 christos 13671 0 9 ./func_abc.sh 16 1.1 christos 17 1.1 christos We see func_abc.sh ran three seperate times, each with nine lines of shell 18 1.1 christos activity. 19 1.1 christos 20 1.1 christos 21 1.1 christos Here we trace an instance of starting Mozilla Firefox. 22 1.1 christos 23 1.1 christos # sh_who.d 24 1.1 christos Tracing... Hit Ctrl-C to end. 25 1.1 christos ^C 26 1.1 christos PID UID LINES FILE 27 1.1 christos 13678 100 1 firefox 28 1.1 christos 13679 100 1 firefox 29 1.1 christos 13680 100 1 firefox 30 1.1 christos 13681 100 1 firefox 31 1.1 christos 13683 100 1 firefox 32 1.1 christos 13685 100 1 firefox 33 1.1 christos 13686 100 1 firefox 34 1.1 christos 13687 100 1 firefox 35 1.1 christos 13690 100 1 firefox 36 1.1 christos 13693 100 1 /usr/lib/firefox/run-mozilla.sh 37 1.1 christos 13694 100 1 /usr/lib/firefox/run-mozilla.sh 38 1.1 christos 13695 100 1 /usr/lib/firefox/run-mozilla.sh 39 1.1 christos 13692 100 55 /usr/lib/firefox/run-mozilla.sh 40 1.1 christos 13677 100 75 firefox 41 1.1 christos 42 1.1 christos Firefox itself (PID 13677) ran 75 lines of code. There are also instances of 43 1.1 christos firefox running a single line of code with a different PID each time. These 44 1.1 christos are probably calls to subshells. Use the sh provider to confirm. 45 1.1 christos 46