2007-05-24, 06:02(-07), Janis:
[...]
> The parent has PID 1 if it is either started by the init process or if
> the real parent process has disowned its child;

Well, no, if the parent has terminated, that's it.

> the latter can be the
> standard behaviour for demon processes, or by calling your process abc
> in a special way like ( abc & )

In that case, the parent (the subshell) terminates just after
having spawned the process that exec()s abc.

> or by manually disown the process
> (if your shell allows that), just to name a few common examples. I
> don't think that it's generally possible in such cases to obtain the
> PPID of the caller.

No, if you're refering to the "disown" command in shells like
zsh or bash, it's only for job control, and that only removes it
from its *internal* job table (so that for instance it doesn't
then the job a SIGHUP signal when it exits).

>> So I need to figure out what is calling the shell command. I've added
>> an echo of $PPID at the beginning of the script - we'll see. But it
>> would be nice to have some additional info. We aren't running process
>> accounting - that might provide me additional info, but isn't an
>> option as far as I am aware.
>
> What "additional info" do you need? You can get everything about the
> process that the ps command on your machine will give you (see man
> page of your ps variant). But only if the process had been started,
> umm.. - "conventionally".
[....]

Basically, what I understand is that there is some process that
does something like:

while true; do
(some-script &)
sleep 1
done

so that ps shows many instances of some-script with ppid 1. The
question is how to find out which process is doing that loop?

looking at which files the instances of some-script have open
or what is their controlling terminal if any may to narrow
down the list of suspects.

--
Stéphane