3 Replies Latest reply: Feb 26, 2013 1:32 AM by 993088 RSS

    unknown userid with defunct processes

    993088
      Hello,

      In my customer's system, we have some defunct processes. Owner userid of most of them are 0000104. This userid is not existing. It seems that user tried to change user. I have made a little search in web and they all say that there should be other zones and that user may be in one of them, but we don't have any zones rather than the global one. Who may this userid be? Why did it try to change user? Customer want to learn this because of security reasons.

      root@ovscp00 # ps -efZ |grep -i defunct_

      global *0000104* 17526 1 0 - ? 0:00 <defunct>

      global *0000104* 21818 1 0 - ? 0:00 <defunct>

      global 0000104 18050 1 0 - ? 0:00 <defunct>

      global 0000104 18026 1 0 - ? 0:00 <defunct>

      global 0000778 654 1 0 - ? 0:00 <defunct>

      global 0000104 4226 1 0 - ? 0:00 <defunct>

      global 0000104 18027 1 0 - ? 0:00 <defunct>

      global 0000104 4202 1 0 - ? 0:00 <defunct>

      global 0000104 4203 1 0 - ? 0:00 <defunct>

      global 0000104 17524 1 0 - ? 0:00 <defunct>

      global root 6981 6781 0 12:31:45 pts/1 0:00 grep -i defunct

      global 0000104 21797 1 0 - ? 0:00 <defunct>

      global 0000104 17529 1 0 - ? 0:00 <defunct>

      global 0000104 21800 1 0 - ? 0:00 <defunct>




      root@ovscp00 # ps -ef |grep -i defunct

      0000104 17526 1 0 - ? 0:00 <defunct>

      0000104 21818 1 0 - ? 0:00 <defunct>

      0000104 18050 1 0 - ? 0:00 <defunct>

      0000104 18026 1 0 - ? 0:00 <defunct>

      0000778 654 1 0 - ? 0:00 <defunct>

      0000104 4226 1 0 - ? 0:00 <defunct>

      0000104 18027 1 0 - ? 0:00 <defunct>

      0000104 4202 1 0 - ? 0:00 <defunct>

      0000104 4203 1 0 - ? 0:00 <defunct>

      0000104 17524 1 0 - ? 0:00 <defunct>

      0000104 21797 1 0 - ? 0:00 <defunct>

      0000104 17529 1 0 - ? 0:00 <defunct>

      0000104 21800 1 0 - ? 0:00 <defunct>

      root 7048 6781 0 12:32:06 pts/1 0:00 grep -i defunct




      root@ovscp00 # ptree 17526_

      17526 <defunct>

      17536 su - ovscrun



      root@ovscp00 # grep ovscrun /etc/passwd_

      ovscrun:x:100:100:OVSC Application User :/global/ovsc:/bin/pfksh



      root@ovscp00 # file /bin/pfksh

      /bin/pfksh: ELF 32-bit MSB executable SPARC Version 1, dynamically linked, stripped

      root@ovscp00 # getconf LONG_BIT

      32



      root@ovscp00 # ptree 21818

      21818 <defunct>

      21822 su - ovscrun



      root@ovscp00 # ptree 18050

      18050 <defunct>

      18054 su – ovscrun