How to determine where an environment variable came from?

If zsh is your login shell:

zsh -xl

With bash:

PS4='+$BASH_SOURCE> ' BASH_XTRACEFD=7 bash -xl 7>&2

That will simulate a login shell and show everything that is done (except in areas where stderr is redirected with zsh) along with the name of the file currently being interpreted.

So all you need to do is look for the name of your environment variable in that output. (you can use the script command to help you store the whole shell session output, or for the bash approach, use 7> file.log instead of 7>&2 to store the xtrace output to file.log instead of on the terminal).

If your variable is not in there, then probably the shell inherited it on startup, so it was set before like in PAM configuration, in ~/.ssh/environment, or things read upon your X11 session startup (~/.xinitrc, ~/.xsession) or set upon the service definition that started your login manager or even earlier in some boot script. Then a find /etc -type f -exec grep -F THE_VAR {} + may help.

Some places to look first:

System wide

• /etc/environment: specifically meant for environment variables
• /etc/env.d/*: environment variables, split in multiple files
• /etc/profile: all types of initialization scripts
• /etc/profile.d/*: initialization scripts
• /etc/bashrc, /etc/bash.bashrc: meant for functions and aliases

User specific

• ~/.bash_profile: initialization for login (bash-)shells
• ~/.bashrc: initialization for all interactive (bash-)shells
• ~/.profile: used for all shells
• ~/.cshrc, ~/.zshrc, ~/.tcshrc: similar for non-bash shells

If you use the env command to display the variables, they should show up roughly in the order in which they were created. You can use this as a guide to if they were set by the system very early in the boot, or by a later .profile or other configuration file. In my experience, the set and export commands will sort their variables by alphabetical order, so that listing isn't as useful.