Same pid, different user?

[Victor_5]

# who -u | grep asookraj
asookraj ttypf Aug. 21 09:30 0:36 2790 172.16.62.57

# ps -ef | grep 2790
asookraj 2790 2789 0 09:30:16 ttypf 5:57 /opt/basis/pro5

However, when I tried to monitor processes by using top, it said that the owner of 2790(pid) is georgep.

Then I used
# who -u | grep georgep
but nothing found related with 2790(pid).

The question is: for the same pid, why I saw two different user names in ps and top? Which one I can rely on?

[Jordan Bean]

multiple users with same pid.

grep :: /etc/passwd

Typically the first user entry found in /etc/passwd is returned getpwuid() et al.

[linuxfan]

Hi Shawn,


Check the uid of georgeop and asookraj in the /etc/passwd.

Also I think Jordan meant "grep :uid: /etc/passwd"

You can also do /usr/bin/pwget -u uid or pwget -n name to get the password entry.

-HTH
Ramesh

[Magdi KAMAL]

Hi Shawn,

This could only be because you had manually modified the /etc/passwd and added a new user with an existing PID number. Try :

#grep :2790: /etc/passwd

and you will have all users with that pid.

Magdi

[linuxfan]

Hi,

Here I thought 2790 is the PID of the process, not the UID.
do a
pwget -n asookraj
pwget -n georgep

Check if they have the same uid?
If georgep doesn't exist, it is possible the UID of georgep was given to asookraj.

-HTH
Ramesh

[Joseph Chakkery]

Hello,
It seems to be user id (UID) is same for both users.

Ramesh is right, find out the UID for both users.

Regards
Joe.

[Victor_5]

Hi Friends:

Thanks for your replies making me more clear, however, I still have questions.

I checked the /etc/passwd, the UID of those two users is quite different, at the same time, when user asookraj was running something, another user georgep did exist.

In my case, I think it is PID issue not UID. One more thing mabye helps. Since user asookraj was using ttypf, I used ps -t, one line of 'ps -t ttypf' said

PID TTY TIME COMMAND
17866 ttypf 0:00

Is it possible the Zombin process cause the problem?

In top output, it gives us PID information, why PID 2790 was related with another user georgep not asookraj?

[Mladen Despic]

Shawn,

You could try the following:

1. who -u | grep ttypf
2. top -u (note the UID for pid 2790)
3. pwget -u (where UID is from #2)

Anything unusual? Just a thought ... Mladen

[Victor_5]

Hi Mladen:

Good way to check!

But you still did not answer my question. Is it possible for two different users own same PID at the same time? Or maybe it is possible after the process became defunct?

[linuxfan]

Hi Shawn,

Do you have a patch for top installed on your system. If it is PHCO_14306 then you need to install the superceeding patch PHCO_22556. The patch description for PHCO_22556 says PHCO_14306 when installed on a system sometimes shows wrong username in top. Not sure if this is your case.

If not what does glance show as the owner for that PID 2970?
Did you already try lsof -p 2970?

-HTH
Ramesh

[linuxfan]

Hi Shawn,

The faulty patch was PHCO_10096 (which resulted in top showing incorrect usernames) which was resolved by PHCO_14306 but the latest patch is PHCO_22556

-Ramesh

[Jordan Bean]

Silly me. Yes, I meant .

Perhaps top is reporting the owner of the tty to which the process is bound rather than the effective uid. This isn't unusual when su is used.

Or perhaps top the defunct process is mangling the search.

[Mladen Despic]

Shawn,

I do not know if it is possible that two different users own the same PID at the same time. I have never seen that happen. If there is no reason for that to happen, then it probably shouldn't.

So, I'm thinking that at least one of the two programs, that report different owners for the same PID, is somehow getting incorrect information about the process. What could be causing this?

Well, it could be a number of things. So, instead of trying to think of all possible reasons, I would try a few commands (as suggested above) and if something unusual does show up, that could be a lead.

Just brainstorming ... Mladen

[Les Schuettpelz]

Dave Fargo using Les's ITRC login.

The -o option of useradd allows creation of ID's with non-unique UID's. Even if this was done, the who, ps and top programs should work the same in regards to which ID would be returned for a UID.

This problem doesn't appear to have anything to do with non-unique UIDs, but rather PID's which are by definition non-unique, and not in any way "reserved" or "assigned" to a UID. They are assigned when a process is created, only for the life of that process, and then "recycled" sequentially as the PID hits the maximum and wraps around to 1.

It may not seem likely, but in this case, what may have happened is, you looked at a process run by asookraj that had a specific PID, and that process ended, and by the time you looked at that PID again, a process run by georgep had started that re-used that specific PID.