phantom process with no PID

[David Preston_4]

I have been testing both from telnet and an x-emulator lately and through some process I created a phantom of sorts that I cannot find to kill. The process shows a device file of pts/2 and appeares to be attached to my desk top PC with my machine name followed by :0.0 as though that should be a port and socket. I have tried finger, who, w, and some process I have in the software I run, but have been unable to remove it or even identify it with a process ID. It does not appear to use any resources, but still exists even after a reboot. Any suggestions would be greatly appreciated.

TIA
Dave

[Alex Glennie]

:0.0 would be the identifier for a remote Xserver's DISPLAY. Check on the PC that you still don't have a Xemulation window/session running on the host.

Perhapsconsider rebooting the PC even ?

[David Preston_4]

Alex, My PC is rebooted daily, and this process has been open for about a month. the only thing I didn't try was to rboot the unix box while the PC is powered off, Do you think that would help?

Dave

[Alex Glennie]

If its connected with X or CDE then try /sbin/init 2 ... non graphics run-level ie X or CDE (dtlogin wont be running), rather than a reboot first.

However I don't fully understand your problem : any chance of clarifying it ... I have access to PC's Xemulation and hpux s700's & s800 how would i reproduce your problem ... an idiots guide will be the right-level of detail I'm looking for.

[David Preston_4]

Alex, I wish I could tell you how to duplicate this, it would be the first step to finding and killing it. unfortunatly I don't know how it started or when. I did find a patch referenced in the technical knowleger db PHSS_14595 that I don't find on my system. that may help.

Dave

[Alex Glennie]

I'd install the latest patch : PHSS_22339 if I installed any...

[Carlos Fernandez Riera]

run netstat -na

search for IP of your PC.

This will show which port and status of connection are using you PC.

HTH

[Jim Pryde]

I have a 725/100 I have thought about selling.
Has 2 4GB disks, 256MB, DAT tape drive, keyboard/mouse adaptor, 28685B EtherTwist
Transceiver, and HP-UX 11.0 installed.

[David Preston_4]

Carlos, I ran the netstat -na with a |grep 68, which is the end of my IP address, while I was doing it from my pc it showed me, but after I logged out and went to the server, i wasn't there. so the process I am looking for is not displaying in netstat.

Dave

[Carlos Fernandez Riera]

David:

Can you attach the result of ps -lft pts/2?

[David Preston_4]

Carlos,
No results, heading only.

Dave

[Carlos Fernandez Riera]

Then ...Why do you say there is a procces ( with unknown ID) attached to my PC?

[David Preston_4]

Carlos,
Here is the output, I get from finger, and who. As you can see in finger the 'on since' and 'days Idle' do not agree. I rebooted on the 14th.

finger -l
Login name: root (messages off)
Directory: / Shell: /sbin/sh
On since Jan 14 14:37:15 on pts/2 from stone68:0.0
41 days Idle Time
No Plan.

who
root pts/2 Jan 14 14:37

But with all that there is no PID and it is not in ps.

Dave

[James R. Ferguson]

Dave:

It appears that your /etc/utmp file is corrupt. 'finger' and 'who' use information from this file. /etc/utmp will be recreated at reboot, but if you don't want to do that, you could edit the bad entry out:

1. /usr/sbin/acct/fwtmp < /etc/utmp > /tmp/utmpa

2. vi /tmp/utmpa # remove the bad entry

3. /usr/sbin/acct/fwtmp -ic < /tmp/utmpa > /etc/utmp

I would also do:

4. cat /dev/null > /var/adm/wtmp

See if this fixes your problem.

...JRF...

[David Preston_4]

Guess what?
I just caused it to happen again, and then cleaned it up.

I opened my x-emulator to use it for downloading a patch from HP. In the process I killed the window (X of Death) without closing the session. out of curiosity I went to my application telnet and there were 2 ts/ entries with no PID. I then reopened the emulator and closed it cleanly. and the bad user session went away, including the old one. Looks like I found the culprit. I dont use the emulator often, my software takes care of most adimin tasks. Its great when a plan comes together.

thanks for all the suggestions. I learned alot through this process.

Dave