username not shown in ps -ef output

[NDO]

hi all!

Please can some help on this one.
Somebody must have changed something, what is happening is that when "ps -ef" it does not show the owner of the process, it onlys shows the the user ID,which is a problem for us because we have an application that has its own user to start it up. Please can somebody help?

Fernando

[James R. Ferguson]

Hi Fernando:

> it does not show the owner of the process, it only shows the the user ID,

This suggests that either (1) the user (account) has been deleted from the system after the process was started; or (2) the permissions of '/etc/passwd' are not world-readable.

Verify your '/etc/passwd' file contains an entry for the 'uid' associated with the process and that the file is world-readable.

Regards!

...JRF...

[NDO]

Hi!

Unfortuately its not only processes owned by a particular user that are not shown in the ps -ef. Even processes owned by root or any user, look below at one listing:
mpecu007[344] / # ps -ef | more
23y0C UID PID PPID C STIME TTY TIME
COMMAND
0 0 0 0 Jan 19 ? 140:15 swapper
0 1 0 0 Jan 19 ? 4:40 init
0 2 0 0 Jan 19 ? 164:01 vhand
0 3 0 0 Jan 19 ? 1893:44 statdaemon
0 4 0 0 Jan 19 ? 9:17 unhashdaemon
0 8 0 0 Jan 19 ? 352:41 supsched
0 9 0 0 Jan 19 ? 0:00 strmem
0 10 0 0 Jan 19 ? 0:00 strweld
0 11 0 0 Jan 19 ? 0:00 strfreebd
0 12 0 0 Jan 19 ? 0:12 ttisr
0 18 0 0 Jan 19 ? 97:44 lvmkd
0 19 0 0 Jan 19 ? 99:28 lvmkd
0 20 0 0 Jan 19 ? 92:07 lvmkd
0 21 0 0 Jan 19 ? 96:19 lvmkd
0 22 0 0 Jan 19 ? 87:41 lvmkd
0 23 0 0 Jan 19 ? 94:18 lvmkd
0 24 0 0 Jan 19 ? 0:00 lvmschedd
305 27349 27347 0 Jan 29 pts/0 0:00 /csh_ceexec
305 27965 1 0 May 5 ? 0:00 /usr/dt/bin/dtexec -open 0 -ttpr
ocid 2.1A06oT 01 27938 13421
0 29 0 0 Jan 19 ? 933:24 vxfsd
305 331 1 0 Apr 29 ? 0:00 /usr/dt/bin/dtterm


Any hints in what could be wrong?

Fernando

[James R. Ferguson · Accepted solution]

Hi (again) Fernando:

Verify that your '/etc/passwd' hasn't been truncated (to a size of zero).

Regards!

...JRF...

[NDO]

Ok, I'll check that, I'm already at home now, and I do not have access from home, I'll let you know tomorrow

Regards

Fernando

[Bill Hassell]

user names are stored in only one place: /etc/passwd. For programs like ps and ll, the user ID (number) is translated to a user name for convenience. The UID number is still the same and processes should run correctly unless there is code that relies on the translated user name. Since /etc/passwd contains the user names, someone may have tried to "improve" security by taking away read permission for /etc/passwd. Or worse, the file has been corrupted with bad editing. As soon as possible open a couple of root logins as asses the damage.

[Dennis Handly]

Are you using NIS? If so, then a failure there would suppress those UIDs. But it seems that root is also suppressed. So your passwd file is bad. Is pwgrd(1M) running?
What OS version are you running?

[Kapil Jha]

Ur ps -ef output shows numbers (0,30..) in UID colums that means its showing uid not username.

What does ps -elf shows.

and yes check passwd file if its intact.

Better u don't log out a root session.

BR,
Kapil+

[NDO]

hi the passwd file has size 854, it looks ok, but if I type whoami at prompt it shows Intruder alert. I will be posting the passwd file soon. Fernandi

[Kapil Jha]

don post passwd file if it has encrypted passwd :)

what does id command shows.

BR,
Kapil+