[SunHELP] Who run what command

[Wally A. Alubankudi]

OK Thanks





From: "Henderson, David" <David.Henderson at let-it-be-thus.com>
Reply-To: sunhelp at sunhelp.org
To: "'sunhelp at sunhelp.org'" <sunhelp at sunhelp.org>
Subject: RE: [SunHELP] Who run what command
Date: Mon, 3 Dec 2001 13:05:40 -0000
MIME-Version: 1.0
Received: from [207.200.6.75] by hotmail.com (3.2) with ESMTP id 
MHotMailBDD4C4140038400438D8CFC8064BCC7E0; Mon, 03 Dec 2001 05:07:34 -0800
Received: from ohno.mrbill.net (localhost [127.0.0.1])by ohno.mrbill.net 
(Postfix) with ESMTPid 8A4EAAB43B; Mon,  3 Dec 2001 07:08:15 -0600 (CST)
Received: from cattelsmtp01.scottishtelecom.com  (relay.scottishtelecom.com 
[194.247.83.217]) by ohno.mrbill.net  (Postfix) with ESMTP id 7424CAB402 for 
<sunhelp at sunhelp.org>; Mon,  3  Dec 2001 07:07:00 -0600 (CST)
Received: from [10.70.9.15] (helo=bsqtelntm06.scottishtelecom.com) by  
cattelsmtp01.scottishtelecom.com with esmtp (Exim 3.03 #4) id  
16AsnG-0006m5-00 for sunhelp at sunhelp.org; Mon, 03 Dec 2001 13:05:58  +0000
Received: by bsqtelntm06.scottishtelecom.co.uk with Internet Mail  Service 
(5.5.2448.0) id <X8SJ8F4L>; Mon, 3 Dec 2001 13:05:24 -0000
>From sunhelp-admin at sunhelp.org Mon, 03 Dec 2001 05:08:05 -0800
Delivered-To: sunhelp at sunhelp.org
Message-ID: 
<658BCF999CDBD211AAE100805FD71D7007420D86 at bsqtelntd04.scottishtelecom.co.uk>
X-Mailer: Internet Mail Service (5.5.2448.0)
Sender: sunhelp-admin at sunhelp.org
Errors-To: sunhelp-admin at sunhelp.org
X-BeenThere: sunhelp at sunhelp.org
X-Mailman-Version: 2.0.8
Precedence: bulk
List-Help: <mailto:sunhelp-request at sunhelp.org?subject=help>
List-Post: <mailto:sunhelp at sunhelp.org>
List-Subscribe: 
<http://www.sunhelp.org/mailman/listinfo/sunhelp>,<mailto:sunhelp-request at sunhelp.org?subject=subscribe>
List-Id: General discussion / help / chat about Sun machines and software 
<sunhelp.sunhelp.org>
List-Unsubscribe: 
<http://www.sunhelp.org/mailman/listinfo/sunhelp>,<mailto:sunhelp-request at sunhelp.org?subject=unsubscribe>
List-Archive: <http://www.sunhelp.org/pipermail/sunhelp/>

What could have happened is that the user account has been deleted after the 
process has started running.

When PS tries to return a username for the userid it fails as there is no 
entry.

Similar to what happens when you tar files from one server to another and 
the user account does on exist on the new system.

Of course this may not be the problem.  It sounds like it is though.

easy test is to create a user, start a vi session as the user and delete the 
user when it's running vi.

Then do a ps and grep for vi and see if it exhibits the same behaviour.

HTH

David Henderson
Computacenter

Direct Dial: 0141 556 3617
Mobile     : 0774 098 3974

-----Original Message-----
From: Wally A. Alubankudi [mailto:walubank at hotmail.com]
Sent: 03 December 2001 12:44
To: sunhelp at sunhelp.org
Subject: [SunHELP] Who run what command


Hi Sun Guru's,
               Unknown user ran a started a netscape. When I ran ps -ef the
username was 0000120   There is no user by this name. How can I find out who
started this process. Or, does anybody know the command  to read the files
in /var/audit/save  I am trying to trace this username. Please HELP.
Wally


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
_______________________________________________
SunHELP maillist  -  SunHELP at sunhelp.org
http://www.sunhelp.org/mailman/listinfo/sunhelp


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
_______________________________________________
SunHELP maillist  -  SunHELP at sunhelp.org
http://www.sunhelp.org/mailman/listinfo/sunhelp
_______________________________________________
SunHELP maillist  -  SunHELP at sunhelp.org
http://www.sunhelp.org/mailman/listinfo/sunhelp


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp