How to determine where an environment variable came from?
I have a Linux instance that I set up some time ago. When I fire it up and log in as root there are some environment variables that I set up but I can’t remember or find where they came from.
- I’ve checked
~/.bash_profile,/etc/.bash_rc, and all the startup
scripts. - I’ve run
findandgrepto no avail.
I feel like I must be forgetting to look in some place obvious. Is there a trick for figuring this out?
@Cian is correct. Other than using find and grep, there isn’t much you can do to discover where it came from. Knowing that it is indeed an environment variable, I would attempt focusing your search in /etc/ and your home directory. Replace VARIABLE with the appropriate variable you’re searching for:
$ grep -r VARIABLE /etc/*
$ grep -r VARIABLE ~/.*
Check your startup scripts for files that they source using . (dot) or source. Those files could be in other directories besides /etc and $HOME.
If you use the env command to display the variables, they should show up roughly in the order in which they were created. You can use this as a guide to if they were set by the system very early in the boot, or by a later .profile or other configuration file. In my experience, the set and export commands will sort their variables by alphabetical order, so that listing isn’t as useful.
If you put set -x in your .profile or .bash_profile, all subsequent shell commands will be logged to standard error and you can see if one of them sets these variables. You can put set -x at the top of /etc/profile to trace it as well. The output can be very verbose, so you might want to redirect it to a file with something like exec 2>/tmp/profile.log.
If your system uses PAM, look for pam_env load requests in /etc/pam.conf or /etc/pam.d/*. This module loads environment variables from the specified files, or from a system default if no file is specified (/etc/environment and /etc/security/pam_env.conf on Debian and Ubuntu). Another file with environment variable definitions on Linux is /etc/login.defs (look for lines beginning with ENV_).
If zsh is your login shell:
zsh -xl
With bash:
PS4='+$BASH_SOURCE> ' BASH_XTRACEFD=7 bash -xl 7>&2
That will simulate a login shell and show everything that is done (except in areas where stderr is redirected with zsh) along with the name of the file currently being interpreted.
So all you need to do is look for the name of your environment variable in that output. (you can use the script command to help you store the whole shell session output, or for the bash approach, use 7> file.log instead of 7>&2 to store the xtrace output to file.log instead of on the terminal).
If your variable is not in there, then probably the shell inherited it on startup, so it was set before like in PAM configuration, in ~/.ssh/environment, or things read upon your X11 session startup (~/.xinitrc, ~/.xsession) or set upon the service definition that started your login manager or even earlier in some boot script. Then a find /etc -type f -exec grep -Fw THE_VAR {} + may help.
environment variables are stored in /etc/profile file so do
more /etc/profile and just check for env variables you want
and if /etc/profile is not present then lokk for .profile file in your home directory
Some places to look first:
System wide
/etc/environment: specifically meant for environment variables/etc/env.d/*: environment variables, split in multiple files/etc/profile: all types of initialization scripts/etc/profile.d/*: initialization scripts/etc/bashrc,/etc/bash.bashrc: meant for functions and aliases
User specific
~/.profile: used for all shells~/.pam_environment: part of Pluggable Authentication Modules for Linux~/.bash_profile: initialization for login (bash-)shells~/.bashrc: initialization for all interactive (bash-)shells~/.cshrc,~/.zshrc,~/.tcshrc: similar for non-bash shells
For zsh users, tracing the files that are accessed (during startup) can be useful, they are not too many and one can look through them one-by-one to find where something was defined.
zsh -o SOURCE_TRACE