topic Re: su problem in Operating System - HP-UX

su problem

Sridhar R — Tue, 27 May 2008 03:29:01 GMT

Hi,

My problem is:

The syslog.log file is generating this message on a continuous basis.

May 27 02:14:39 bidrdev1 su: + tty?? root-oracle
May 27 02:14:41 bidrdev1 above message repeats 238 times
May 27 02:14:45 bidrdev1 su: + tty?? root-oracle
May 27 02:34:37 bidrdev1 su: + tty?? root-oracle
May 27 02:34:41 bidrdev1 above message repeats 237 times
May 27 02:34:42 bidrdev1 su: + tty?? root-oracle
May 27 02:54:40 bidrdev1 su: + tty?? root-oracle
May 27 02:54:41 bidrdev1 above message repeats 238 times
May 27 02:54:45 bidrdev1 su: + tty?? root-oracle
May 27 03:14:37 bidrdev1 su: + tty?? root-oracle
May 27 03:14:41 bidrdev1 above message repeats 237 times
May 27 03:14:42 bidrdev1 su: + tty?? root-oracle
May 27 03:34:40 bidrdev1 su: + tty?? root-oracle
May 27 03:34:41 bidrdev1 above message repeats 238 times
May 27 03:34:45 bidrdev1 su: + tty?? root-oracle
May 27 03:54:38 bidrdev1 su: + tty?? root-oracle
May 27 03:54:41 bidrdev1 above message repeats 237 times
May 27 03:54:43 bidrdev1 su: + tty?? root-oracle
May 27 04:14:37 bidrdev1 su: + tty?? root-oracle
May 27 04:14:41 bidrdev1 above message repeats 237 times
May 27 04:14:42 bidrdev1 su: + tty?? root-oracle
May 27 04:34:39 bidrdev1 su: + tty?? root-oracle
May 27 04:34:41 bidrdev1 above message repeats 238 times
May 27 04:34:44 bidrdev1 su: + tty?? root-oracle
May 27 04:54:37 bidrdev1 su: + tty?? root-oracle
May 27 04:54:41 bidrdev1 above message repeats 237 times
May 27 04:54:43 bidrdev1 su: + tty?? root-oracle
May 27 05:14:40 bidrdev1 su: + tty?? root-oracle
May 27 05:14:41 bidrdev1 above message repeats 238 times
May 27 05:14:45 bidrdev1 su: + tty?? root-oracle
May 27 05:34:38 bidrdev1 su: + tty?? root-oracle
May 27 05:34:42 bidrdev1 above message repeats 237 times
May 27 05:34:43 bidrdev1 su: + tty?? root-oracle

This is the HP-UX 11.23 Server.

I know for sure that the oracle user didn't su that many number of times, but why is that am i getting such messages regularly. How to overcome this?

Kindly provide a good solution for this!!

Thanks in Advance!

Sridhar

Re: su problem

Dennis Handly — Tue, 27 May 2008 03:41:54 GMT

>The syslog.log file is generating this message on a continuous basis.

This is as expected. You have cron job that keeps doing su from root to oracle.

Re: su problem

SUDHAKAR_18 — Tue, 27 May 2008 04:22:49 GMT

Hi,

Can u check any job is scheduled in cron?

do #crontab -l

or any script may run in background.
do #ps -ef |grep oracle and check for processes.

Regards,
SHR

Re: su problem

Steven E. Protter — Tue, 27 May 2008 05:35:13 GMT

Shalom,

The oracle startup script does an su to oracle from root user.

It's also common to do this with root cron scripts that need to run as oracle,as any database scripts should.

There is nothing wrong with what I see in this log. Check your cron schedule for root.

SEP

Re: su problem

Sridhar R — Tue, 27 May 2008 06:32:03 GMT

Hi,

I dont find any cron scheduling by the root user.

But, i can find the oracle processes running.

# ps -ef | grep -i oracle
ias 25632 1 0 May 26 ? 0:00 oracleinfra (LOCAL=NO)
ias 25473 1 0 May 26 ? 0:00 oracleinfra (LOCAL=NO)
root 26272 22929 0 12:22:18 pts/0 0:00 grep -i oracle
ias 25454 1 0 May 26 ? 0:17 oracleinfra (LOCAL=NO)
ias 25475 1 0 May 26 ? 0:00 oracleinfra (LOCAL=NO)
ias 25479 1 0 May 26 ? 0:01 oracleinfra (LOCAL=NO)
ias 25477 1 0 May 26 ? 0:01 oracleinfra (LOCAL=NO)
ias 25506 1 0 May 26 ? 0:00 oracleinfra (LOCAL=NO)
ias 25508 1 0 May 26 ? 0:00 oracleinfra (LOCAL=NO)
ias 25510 1 0 May 26 ? 0:00 oracleinfra (LOCAL=NO)
ias 25512 1 0 May 26 ? 0:00 oracleinfra (LOCAL=NO)
ias 25514 1 0 May 26 ? 0:00 oracleinfra (LOCAL=NO)

Is this what creating such logs?

Thanks!

Re: su problem

Dennis Handly — Tue, 27 May 2008 06:49:57 GMT

>I don't find any cron scheduling by the root user.

Some root process is doing su to oracle.

>i can find the oracle processes running ... Is this what creating such logs?

Well, if these are started by the root process.
Unfortunately since the parent of each is init, you can no longer tell who the parent was.

Re: su problem

Rasheed Tamton — Tue, 27 May 2008 07:19:50 GMT

Hi,

See whether the ias or oracle users have cronjob running as below:

crontab -l ias
crontab -l oracle

or
ll /var/spool/cron/crontabs

Compare the timing of cron jobs with the syslog entries and /var/adm/sulog

Regards,
Rasheed Tamton.

Re: su problem

SUDHAKAR_18 — Tue, 27 May 2008 08:18:11 GMT

Can you check for any software corruptions(using swlist)?

.

Re: su problem

Peter Nikitka — Tue, 27 May 2008 08:34:48 GMT

Hi,

your "oracle" processes are running under the UID of "ias", not oracle.

ps -fuoracle
would list all processes of user oracle.
There may be no processes listed by the ps command even when one may exist, when the execution time is very short.
As an example:
This loop will create entries of such type:

until su oracle non-existing-command
do :
done

Can it be that a supervising script - checking oracle processes - is running but no longer applicable?

mfG Peter

Re: su problem

Heironimus — Tue, 27 May 2008 15:34:00 GMT

All those "LOCAL=NO" processes are just listener processes for connections from other systems. They shouldn't have any connection to your log messages, which are caused by some root-owned process repeatedly suing to oracle.

Re: su problem

TTr — Tue, 27 May 2008 17:11:31 GMT

Did anybody notice the times? It is happening on the 14th, 34th and 54th minute of every hour either 238 or 239 times. There is definitely something scheduled on these times. If there is nothing in cron, maybe there is another process scheduler running? You should monitor your server at those 3 different minutes and see what processes are running. Use a simple ps command or glance if you have it. Is it maybe an oracle backup job?