su: + tty?? root-oracle

[KumarP_1]

Hi

My syslog.log is showing the following messages for every 5 seconds from last few days.
-------------------
Mar 10 17:26:16 hostname su: + tty?? root-oracle
-----------------------------
We are not running Oracle application on the server even though we have oracle id.
What may be the reason ?

Regards
Kumar

[inukoti13]

Hi kumar,

User root had switched to user oracle using su command . Oracle is not any default account.Some body might have created it .
please check by command users ? who are logged in ?

OR command w
please give us the output.

[Mounaam · Accepted solution]

Hi,

these su are are executed by a process that is not attached to a tty (tty??).

Do you have some process like "sleep 5" for example that are running?
If yes, check for the parent process.

[Matti_Kurkela]

Something with no TTY assigned to it is using su to change its identity from "root" to "oracle". Maybe it's something started from crontab?

Check /var/adm/cron/log to see if there is cron activity going on at that time. Also check root's crontab: "crontab -l root"

MK

[Kapil Jha]

you may want to check
lsof|grep tty
who -u
try to find old process which is related to this.
Kill the tty processes which is not used.
BR,
Kapil

[Yogeeraj_1]

hi Kumar,

it could also be that you have a cron job scheduled to run every few minutes.

post the output of:
crontab -l|grep oracle


kind regards
yogeeraj

[KumarP_1]

Hi ,

Thanks all of you for your suggestions.

Mounaam's suggestion solved the problem.

There is one process sleep 5 ( related to oracle ) which is running. I have killed the parent process and problem was solved.


Thanks again.
Kumar