Check the IP address of the process

[peterchu]

I found a dead process in the system like below , I want to trace who run this process , (userA is the common ID ), for the below limited information , can I know which user ( IP address ) run this process ? thx

# ps -ef |grep userA
userA 2394 1 0 10:07 ? 00:00:00 login -- userA

[malay boy]

command "who -u" will show user login from which machine.

regards
mB

[Joseph Loo · Accepted solution]

hi,

do u have lsof? if not:

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.70/

select the download based on the HP-UX version.

regards.

[Rajesh D L]

Hi,

#who -u |grep 2394

regards,
RDL.

[Bharat Katkar]

Hi,
Use
# ps -ef | grep processname

Trace the ttyname in this output.

# who -R | grep

This gives you the IP Address of te user who fired this process.

This should help.
regards,

[peterchu]

thx all replies,
sorry to misleading , I have already killed all the process , so I think I need to check it on the history , is it possible ? thx.

[Bruno Ganino]

I would check users history file
or maybee look into /var/logs
Bruno

[Bharat Katkar]

It looks like diffucult to trace the killed processes and info about them.
But if these processes are related to any application then may be you can refer the logs generated by that application to get more info.

Hope that helps.
regards,