1These are examples of the results after running the sh_who.d script. 2 3This script shows which UIDs and PIDs are running shell scripts, and how 4active they are. It measures the number of lines executed according to 5the line probe - which is a useful, but rough measure of shell activity. 6 7Here it runs as a script executes three times. 8 9# sh_who.d 10Tracing... Hit Ctrl-C to end. 11^C 12 PID UID LINES FILE 13 13663 0 9 ./func_abc.sh 14 13667 0 9 ./func_abc.sh 15 13671 0 9 ./func_abc.sh 16 17We see func_abc.sh ran three seperate times, each with nine lines of shell 18activity. 19 20 21Here we trace an instance of starting Mozilla Firefox. 22 23# sh_who.d 24Tracing... Hit Ctrl-C to end. 25^C 26 PID UID LINES FILE 27 13678 100 1 firefox 28 13679 100 1 firefox 29 13680 100 1 firefox 30 13681 100 1 firefox 31 13683 100 1 firefox 32 13685 100 1 firefox 33 13686 100 1 firefox 34 13687 100 1 firefox 35 13690 100 1 firefox 36 13693 100 1 /usr/lib/firefox/run-mozilla.sh 37 13694 100 1 /usr/lib/firefox/run-mozilla.sh 38 13695 100 1 /usr/lib/firefox/run-mozilla.sh 39 13692 100 55 /usr/lib/firefox/run-mozilla.sh 40 13677 100 75 firefox 41 42Firefox itself (PID 13677) ran 75 lines of code. There are also instances of 43firefox running a single line of code with a different PID each time. These 44are probably calls to subshells. Use the sh provider to confirm. 45 46