[RndTbl] at command (John Donovan)

[jd]

 From where I'm at

a) if it's being logged as having been run as user theo
then we know theo is in /etc/at.allow
Maybe anticipate the mystery process' next run and
temporarily remove/disallow user theo
Later, see error log for user theo
The fully-spelled mystery command may show up.

Also check root's error log
(or errlog of anyone else in /etc/at.allow)
in case the mystery command is invoked by
spoofing .. $ sudo su theo -c "/explicitpath/script.sh"

And, further on Theodore's mention of the -m option for at

b1) I am a fan of alias, so .. add to your ~/bashrc
alias at='/usr/bin/at -m'

(for this Debian+bash example:
to be accurate in spelling out the explicit invoke path, here, I did a $ 
which at
and I was surprised to learn Ubuntu/Mint does not include it [at] in 
default install)
Hmpf.

b2) $ sudo mv /usr/bin/at /usr/bin/_at
Then write a clever script named /usr/bin/at ( <-- no .SH this time)
That can jot out a few notes about how & when it got called,
then invoke the intended process, calling the re-named binary _at

c) Optional reading - - at-tangent at ack-ack attack - -

Early OCR would substitute a default character for any it could not 
recognise, into its text output.
The chosen char was commonly @
Until you tuned scan resolution, etc (or until better OCR came along)
your output would contain a lot of @

My pal Walter Gibbons is blind and in ancient days,
we futzed with his kit to run OCR output thru his spiffy DECTalk 
TextToSpeech jobby,
which would faithfully voice each @ simply as "AT"
In the tuning, we sure laughed a lot (and swore) @ all the @ @ @,
and we still n at ter at each other "AT AT, AT-AT-AT" for lev at y.

Meanwhile .. my theory is th@ one of the writers of "Mars @tacks!"
must have also run flaky OCR output through TextToSpeech
and those creepy aliens' eery language was h at ched !

I pointed out to Walter that one of the sc at ological folk-names for the 
"@"-sign was dog[poop],
and I pointed out further that we can 'train' the TextToSpeech to 
pronounce @ any way we wish.
Walter cog at ated a bit, and declined the enhancement.
Just as well, for soon, email was everywhere,
and his system might have voiced:
" EmailName DOG[POOP] email.com "