Showing results for 
Search instead for 
Did you mean: 

Re: su: + tty?? root-oracle

Go to solution
Occasional Contributor

su: + tty?? root-oracle


My syslog.log is showing the following messages for every 5 seconds from last few days.
Mar 10 17:26:16 hostname su: + tty?? root-oracle
We are not running Oracle application on the server even though we have oracle id.
What may be the reason ?

New Member

Re: su: + tty?? root-oracle

Hi kumar,

User root had switched to user oracle using su command . Oracle is not any default account.Some body might have created it .
please check by command users ? who are logged in ?

OR command w
please give us the output.

Trusted Contributor

Re: su: + tty?? root-oracle


these su are are executed by a process that is not attached to a tty (tty??).

Do you have some process like "sleep 5" for example that are running?
If yes, check for the parent process.
Honored Contributor

Re: su: + tty?? root-oracle

Something with no TTY assigned to it is using su to change its identity from "root" to "oracle". Maybe it's something started from crontab?

Check /var/adm/cron/log to see if there is cron activity going on at that time. Also check root's crontab: "crontab -l root"

Honored Contributor

Re: su: + tty?? root-oracle

you may want to check
lsof|grep tty
who -u
try to find old process which is related to this.
Kill the tty processes which is not used.
I am in this small bowl, I wane see the real world......
Honored Contributor

Re: su: + tty?? root-oracle

hi Kumar,

it could also be that you have a cron job scheduled to run every few minutes.

post the output of:
crontab -l|grep oracle

kind regards
No person was ever honoured for what he received. Honour has been the reward for what he gave (clavin coolidge)
Occasional Contributor

Re: su: + tty?? root-oracle

Hi ,

Thanks all of you for your suggestions.

Mounaam's suggestion solved the problem.

There is one process sleep 5 ( related to oracle ) which is running. I have killed the parent process and problem was solved.

Thanks again.