To identify how these executables (bash18, sh18, init18, etc.) are set in the user daemon crontab using XAMPP on a Linux server, you can follow these steps:

Locate the Crontab File:
First, you need to find the crontab file for the user daemon. Typically, crontab files are located in the /var/spool/cron/crontabs directory. Each user has their own crontab file, named after their username.

Check the Crontab Contents:
Once you've located the crontab file for the user daemon, you can examine its contents. You can use a text editor like nano or vi to view the file. Alternatively, you can use the crontab -l command followed by the username to list the contents of the user's crontab.

Identify XAMPP-related Entries:
Look for any entries in the crontab file that execute scripts or commands related to XAMPP. These entries might include commands to start/stop XAMPP services, backup databases, or perform other tasks.

Inspect the Commands:
For each XAMPP-related entry, inspect the command being executed. This will help you identify which executables (bash18, sh18, init18, etc.) are being called and how they are being used.

Here's an example of how you might do this:

sudo cat /var/spool/cron/crontabs/daemon # Replace 'daemon' with the actual username of the daemon user

or

sudo crontab -u daemon -l

This command will display the contents of the crontab file for the user daemon. Look through the output to find any entries related to XAMPP.

Once you've identified the relevant entries, you can analyze the commands being executed to understand how the executables are being used and where they are located. If any of the executables (bash18, sh18, init18, etc.) are not found in standard system directories like /bin, /usr/bin, or /usr/local/bin, you may need to search the XAMPP installation directory or other custom directories specified in the crontab entries.

Another Way

To identify how these executables (bash18, sh18, init18, etc.) are set in the user daemon crontab on a Linux server, you can use the grep command to search for occurrences of these executables in the crontab files. Here's how you can do it:

sudo grep -R 'bash18\|sh18\|init18' /var/spool/cron/crontabs/*