Is there a way to identify a script is being run as an at job instead of interactively from the shell by a user?
Some of our scripts have a guard to check if they're running in screen by checking $TERM. I'm trying to figure out if I can intelligently check how execution of the script was initiated so I can update that guard statement OR if I should add an option that should always be included when run from an at job.
You could check the parent process name by using the ${PPID} environment variable and looking for that in ps.
Enable logging for the job-execution subsystems. More specifically, cron and at will log to syslog by default, so you simply need to ensure the logged events are persisted. You might want to add the following to your /etc/syslog.conf
After adding that, reboot the syslog daemon, to cause him to pick up the newly added configuration parameters. At that point, you have a record of the scheduled jobs that have been run, and can compare a job to the record of its execution. [1]
To check all users' schedules at a point-in-time, you may want to do the following, which would list their jobs in the report at /tmp/schedulereport
Of course, if you are wanting to prevent users who are not authorized from scheduling jobs, you can add only the authorized users to "cron.allow" and "at.allow" and all users not listed will be unable to run the "crontab" or "at" or "batch" commands.
1: Note, the star means debug-level logging, which can get very verbose. If the logs fill with unactionable information, you may want to replace the "*" with "info"
Another option is to use
pstree
In this case both PID 4452 and 4453 are scripts that were launched via crond.