topic Re: su: + tty?? root-oracle in Operating System - HP-UX

su: + tty?? root-oracle

KumarP_1 — Mon, 10 Mar 2008 08:34:27 GMT

Hi

My syslog.log is showing the following messages for every 5 seconds from last few days.
-------------------
Mar 10 17:26:16 hostname su: + tty?? root-oracle
-----------------------------
We are not running Oracle application on the server even though we have oracle id.
What may be the reason ?

Regards
Kumar

Re: su: + tty?? root-oracle

inukoti13 — Mon, 10 Mar 2008 08:44:28 GMT

Hi kumar,

User root had switched to user oracle using su command . Oracle is not any default account.Some body might have created it .
please check by command users ? who are logged in ?

OR command w
please give us the output.

Re: su: + tty?? root-oracle

Mounaam — Mon, 10 Mar 2008 10:11:16 GMT

Hi,

these su are are executed by a process that is not attached to a tty (tty??).

Do you have some process like "sleep 5" for example that are running?
If yes, check for the parent process.

Re: su: + tty?? root-oracle

Matti_Kurkela — Mon, 10 Mar 2008 11:29:24 GMT

Something with no TTY assigned to it is using su to change its identity from "root" to "oracle". Maybe it's something started from crontab?

Check /var/adm/cron/log to see if there is cron activity going on at that time. Also check root's crontab: "crontab -l root"

MK

Re: su: + tty?? root-oracle

Kapil Jha — Mon, 10 Mar 2008 11:44:41 GMT

you may want to check
lsof|grep tty
who -u
try to find old process which is related to this.
Kill the tty processes which is not used.
BR,
Kapil

Re: su: + tty?? root-oracle

Yogeeraj_1 — Mon, 10 Mar 2008 11:55:53 GMT

hi Kumar,

it could also be that you have a cron job scheduled to run every few minutes.

post the output of:
crontab -l|grep oracle

kind regards
yogeeraj

Re: su: + tty?? root-oracle

KumarP_1 — Tue, 11 Mar 2008 06:50:54 GMT

Hi ,

Thanks all of you for your suggestions.

Mounaam's suggestion solved the problem.

There is one process sleep 5 ( related to oracle ) which is running. I have killed the parent process and problem was solved.

Thanks again.
Kumar