How do I determine what file calls a bash command at login?

I’m a computer science student on Mac OSX El Capitan. My friend made it so that my computer runs say 'heil hitler' whenever I login to a new instance of Terminal. Needless to say, I need to get rid of it. For now, I have renamed /usr/bin/say to /usr/bin/0say to keep it from going off in public. I have checked ~/.bash_profile, ~/.bashrc, ~/.login, /etc/bashrc. Are there other files automatically run at bash login?

Beyond that, how can I find out what config file is actually calling a given command?

Use the set command, man page here. Specifically:

• set -x to show commands after expansion, just before execution

• set -v to show commands as they are read in, before expansion

For example, insert set -xv at the top of your ~/.profile and you will see everything your terminal is doing after that line. You may want to capture that output (or copy-paste from Terminal into a text document) and do something like grep -B 4 hitler to give you an idea of where it is.

Several investigation techniques come to mind:

• In addition to the shell init files you looked at, check ~/.profile, ~/.bash_login, and /etc/profile.

• For the per-user init files, try disabling them by renaming; if removing one particular file keeps it from running say, then you know it’s something in that file. You can also put a return command partway through an init file to see if the call to say is before or after that point.

• You can add set -x in an init file, and it’ll make the shell print out commands as it executes them; makes tracing execution easy.

• Brute force search your home folder: grep -r hitler ~

It looks like you’ve already solved the problem but I would have also checked my Terminal shortcut. It could have been replaced with any number of script shortcuts, AppleScript being the most likely, to perform this prank.