su: (to sybsid) root on none

[Former Member]

Hi all,

on linix (SLES SP02) I see a lot of entries in /var/log/messages:

 su: (to sybsid) root on none

The entry occurs quit frequent - around 70 times per minute.

Any ideas which process triggers the su?

Arne

[Former Member]

understood now, that this is "normal" Linux logging. The switch user command is written in linux messages.

The systems are working fine - so this is not an error message.

I'm wondering why (especially) sybsid does so many switch users in such a short period.

[christoph_heimann]

Hi Arne,

do you have a SAP Host Agent (SHA) installed on this box? If yes --> this mighty be the SAP Host Agent. Every time when SAP Host Agent is checking the status of the ASE it will execute a number of commands like this: "su -l sybsid -s /bin/sh -c ".....". Depending on your linux logging configuration this will be logged in the /var/log/messages.

Best regards

Christoph

[Former Member]

Hi Christoph,

great - this was the right hint.

Saphostagent is the one who is responsible for the su.

I upgrated saphostagent to SP190

In the log file of saphostagent i can find the following entries:

Wed Sep  3 14:49:28 2014
[PID 661] libsapdbsybctrl version 720 04/29/2014 14:35.00
Password:
Password:
Password:
Password:
Password:
Password:
Password:
...

Nice to know which process issues the entries in the messages. For security reasons I cannot disable switch user logging for Linux in total.

So I have either a log file which is senseless because of flooding entries of su or I violate the security policy.

saphostagent is running for all databases unter root user. Therefore, the su command is issued by saphostagent, too to connect to i.e. oracle.

Why are not the same entries thousand times in the /var/log/messages for other databases?

[former_member182259]

Is ASE running as root or sybsid??

[Former Member]

as sybsid