su - root as root???

[Mike Barron_3]

Anyone ever see this in the syslog?:

Jul 11 03:03:35 pfuxdbp1 above message repeats 19 times
Jul 11 03:04:07 pfuxdbp1 su: + tty?? root-root
Jul 11 03:23:08 pfuxdbp1 su: + tty?? root-root

This is going on every minute....

[Devender Khatana]

Hi,

Any user when do a "su - root" this message gets logged. The tty reprents the tty session where that was done.

HTH,
Devender

[Rick Garland]

Seen this many times. We forget we are root when we do the su -

Every minute is something to investigate. Can start by looking at the /var/adm/sulog as well.

[Patrick Wallek]

I would check you root crontab file and look for any job running every minute. If there are any, then check those to see if they are doing an 'su - root'.

They may be doing an su to set some environment variables for a script. Or it could be the syntax 'su - root -c /dir/somescriptname'.

Cron would be my first check.

[saju_2]

Hi

This is because su - root is executed. If this is seen in regular intervel then there will be some script in cron which runs in the background doing su - root.

Regrads
CS

[Mike Barron_3]

the weird thing is I did check the cron and there are no jobs running every minute.

also its running as root and suing to root..

[Patrick Wallek]

What about 'at' jobs? What does 'at -l' show?

Do you happen to use a third party scheduler like Autosys, Maestro, IBM Tivoli Workload Scheduler?

What about some other process someone started? Try doing a 'ps -ef |grep sleep' and look for a 'sleep 60' or something similar. Then look at the sleep processes PPID and then look for that process id and see what it is.

[Devender Khatana]

Hi,

It could be a script of some non root user which has UID set & doing a su - root.

Su - root from root is usual in scripts.
#ps -ef|grep -i su at regular intervals shall help.

HTH,
Devender

[Animesh Chakraborty]

+ tty?? means it is running from cron job as no specific terminal is indicated.

Please ckeck your root cronjob again. It will be inside some scripts which are running via cron every 20 minutes.