From owner-freebsd-questions Fri Jun 19 05:17:36 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id FAA27483 for freebsd-questions-outgoing; Fri, 19 Jun 1998 05:17:36 -0700 (PDT) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from federation.addy.com (federation.addy.com [207.239.68.2]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id FAA27457 for ; Fri, 19 Jun 1998 05:17:29 -0700 (PDT) (envelope-from fbsdlist@federation.addy.com) Received: from localhost (fbsdlist@localhost) by federation.addy.com (8.8.5/8.6.12) with SMTP id IAA06950 for ; Fri, 19 Jun 1998 08:17:30 -0400 (EDT) Date: Fri, 19 Jun 1998 08:17:30 -0400 (EDT) From: Cliff Addy To: questions@FreeBSD.ORG Subject: "ghost" user Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG I'm seeing something a little wierd on one of our servers. A who shows apache ttyp0 Jun 19 08:06 (borg) gschryer ttyp2 Jun 18 15:08 (135.205.95.104) but gschryer is *not* logged in. Furthermore, a w shows USER TTY FROM LOGIN@ IDLE WHAT apache p0 borg 8:06AM - w gschryer p2 H-135-205-95-104 Thu03PM 16:59 - i.e. this "ghost" user appears to be doing nothing. If I do a "ps aux | grep gschryer" it returns nothing, i.e. no processes owned by gschryer, not even a shell. And grepping for "p2" also returns nothing, there aren't even any processes owned by *any* ttys other than the p0 I'm on. Huh? gschryer pointed this out to me, so I don't think there's anything sinister going on. But how could this happen and how (other than a reboot) can I make it go away? To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message