This discussion is archived
3 Replies Latest reply: Feb 25, 2013 11:32 PM by 993088 RSS

unknown userid with defunct processes

993088 Newbie
Currently Being Moderated
Hello,

In my customer's system, we have some defunct processes. Owner userid of most of them are 0000104. This userid is not existing. It seems that user tried to change user. I have made a little search in web and they all say that there should be other zones and that user may be in one of them, but we don't have any zones rather than the global one. Who may this userid be? Why did it try to change user? Customer want to learn this because of security reasons.

root@ovscp00 # ps -efZ |grep -i defunct_

global *0000104* 17526 1 0 - ? 0:00 <defunct>

global *0000104* 21818 1 0 - ? 0:00 <defunct>

global 0000104 18050 1 0 - ? 0:00 <defunct>

global 0000104 18026 1 0 - ? 0:00 <defunct>

global 0000778 654 1 0 - ? 0:00 <defunct>

global 0000104 4226 1 0 - ? 0:00 <defunct>

global 0000104 18027 1 0 - ? 0:00 <defunct>

global 0000104 4202 1 0 - ? 0:00 <defunct>

global 0000104 4203 1 0 - ? 0:00 <defunct>

global 0000104 17524 1 0 - ? 0:00 <defunct>

global root 6981 6781 0 12:31:45 pts/1 0:00 grep -i defunct

global 0000104 21797 1 0 - ? 0:00 <defunct>

global 0000104 17529 1 0 - ? 0:00 <defunct>

global 0000104 21800 1 0 - ? 0:00 <defunct>




root@ovscp00 # ps -ef |grep -i defunct

0000104 17526 1 0 - ? 0:00 <defunct>

0000104 21818 1 0 - ? 0:00 <defunct>

0000104 18050 1 0 - ? 0:00 <defunct>

0000104 18026 1 0 - ? 0:00 <defunct>

0000778 654 1 0 - ? 0:00 <defunct>

0000104 4226 1 0 - ? 0:00 <defunct>

0000104 18027 1 0 - ? 0:00 <defunct>

0000104 4202 1 0 - ? 0:00 <defunct>

0000104 4203 1 0 - ? 0:00 <defunct>

0000104 17524 1 0 - ? 0:00 <defunct>

0000104 21797 1 0 - ? 0:00 <defunct>

0000104 17529 1 0 - ? 0:00 <defunct>

0000104 21800 1 0 - ? 0:00 <defunct>

root 7048 6781 0 12:32:06 pts/1 0:00 grep -i defunct




root@ovscp00 # ptree 17526_

17526 <defunct>

17536 su - ovscrun



root@ovscp00 # grep ovscrun /etc/passwd_

ovscrun:x:100:100:OVSC Application User :/global/ovsc:/bin/pfksh



root@ovscp00 # file /bin/pfksh

/bin/pfksh: ELF 32-bit MSB executable SPARC Version 1, dynamically linked, stripped

root@ovscp00 # getconf LONG_BIT

32



root@ovscp00 # ptree 21818

21818 <defunct>

21822 su - ovscrun



root@ovscp00 # ptree 18050

18050 <defunct>

18054 su – ovscrun

Legend

  • Correct Answers - 10 points
  • Helpful Answers - 5 points