[SunHELP] Who run what command

[Henderson, David]

What could have happened is that the user account has been deleted after the process has started running.

When PS tries to return a username for the userid it fails as there is no entry.

Similar to what happens when you tar files from one server to another and the user account does on exist on the new system.

Of course this may not be the problem.  It sounds like it is though.

easy test is to create a user, start a vi session as the user and delete the user when it's running vi.

Then do a ps and grep for vi and see if it exhibits the same behaviour.

HTH

David Henderson
Computacenter

Direct Dial: 0141 556 3617
Mobile     : 0774 098 3974

-----Original Message-----
From: Wally A. Alubankudi [mailto:walubank at hotmail.com]
Sent: 03 December 2001 12:44
To: sunhelp at sunhelp.org
Subject: [SunHELP] Who run what command


Hi Sun Guru's,
              Unknown user ran a started a netscape. When I ran ps -ef the
username was 0000120   There is no user by this name. How can I find out who
started this process. Or, does anybody know the command  to read the files
in /var/audit/save  I am trying to trace this username. Please HELP.
Wally


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
_______________________________________________
SunHELP maillist  -  SunHELP at sunhelp.org
http://www.sunhelp.org/mailman/listinfo/sunhelp


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
_______________________________________________
SunHELP maillist  -  SunHELP at sunhelp.org
http://www.sunhelp.org/mailman/listinfo/sunhelp