Re: some process flooding oracle's .sh_history file

On Jul 31, 2:02 pm, EdStevens <quetico_..._at_yahoo.com> wrote:
> Platform: Oracle 10.2.0.2.0 on HP-UX B.11.11
>
> This began just recently. While logged on to the sever with the
> 'oracle' account, I noticed my command line history returning a bunch
> of stuff I hadn't entered. This is a very small shop, so I have a
> pretty good feel for when someone else may be logged on, and the
> commands in the history didn't look like anything any of us would have
> entered at the command line.
>
> Looking into oracle's .sh_history file, I found scores of entries like
> this:
>
> 2 echo Start Command;LC_ALL=C;export LC_ALL;netstat -i; echo Finish
> Command
> 3 echo Start Command; LC_ALL=C;export LC_ALL;/etc/swapinfo -t | grep
> total;echo Finish Command
>
> ( I've left the vi line numbers, to deliniate individual records.)
>
> Looks like something the dbcontrol agent would be doing to gather
> stats, but if so, I've never seen it show up in the .sh_history file
> before.
>
> Anyone seen anything like this, or have and educated idea?

One thing to try would be something like last, which would at least show you who was logged in at a given time, or sulog, which will show you who su'd and when.

Regards,

Steve Received on Tue Jul 31 2007 - 15:36:58 CDT