Who (which process) is calling curl?

Question

On my mac (Lion), I know that curl is bing used by some unknown process to communicate with a server.

Basically I installed little Snitch and find out that "somebody" is using curl periodically.
How can I find out who (what process) is firing up these curl calls?
I guess if a process is directly calling curl I should be able to find who it is (if it is still around by the time I look for it) by checking the process tree (parent to curl).

Are there any best practices or specialized utilities to help with this?

Answer 1

sudo cp /usr/bin/curl /usr/bin/curl.bin
sudo vim /usr/bin/curl.wrapper

here is the wrapper:

#!/bin/sh

date >> /var/tmp/curl_ppid.log
ps -f -p $PPID >> /var/tmp/curl_ppid.log

exec curl.bin "$@"

and then:

sudo chmod 755 /usr/bin/curl.wrapper
sudo touch /var/tmp/curl_ppid.log
sudo chmod a+w /var/tmp/curl_ppid.log
sudo ln -sf /usr/bin/curl.wrapper /usr/bin/curl

It is better to keep the wrapper script in another location called curl.wrapper, so your package manager will not overwrite your script during an update.

Answer 2

Replace the curl binary with a script to capture the process details.

Answer 3

Because MacOS is Unix-based, "lsof" command will work.

Try:

sudo lsof -i -P | grep -i "curl"

or just

lsof -i