Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Say, on a Solaris server, user1 logs in, switches to someother user, say sruser, using su - and then starts a process of id X. And then another user user2 logs in, switches to sruser the same way and starts a process of id Y. (Multiple users can log in and swithch to sruser simultaneously.)

In the above scenario, is there any way we can trace the processes of ids X and Y to the actual users user1 and user2?

How can we trace a process to the original user?

share|improve this question

there are commands to generate the process tree. The 'ps' take options 'fu' , and i think sun has ptree.

share|improve this answer
Thanks for pointing me towards ptree. It did give encouraging results. From the process tree, with a little guess work, i was able to trace back to the actual user. But i'm not sure what this process is - /usr/lib/ssh/sshd. I've heard of ssh but not sshd. – Srikanth Mar 3 '11 at 21:47
sshd will be ssh deamon .. sth that talks to to ssh, which is on client site .. just like you have a http server ... – Vardhan Mar 4 '11 at 1:12

There is no standard way, and as far as I know there is no Solaris way either. If there was a reliable way to find out the “ancestor” user, the usual unix security model where root can do everything would not hold.

You can check each process's parent recursively. (Warning, untested script.)

pid=$1 pids=$pid user=
while pid=$(ps -o ppid= $pid); do
  user=$(ps -o ruser= $pid)
  case $user in
    0|root) :;;
    *) break;;
echo $user

This is not guaranteed to give any result, though. Maybe the parent's parent's parent process has exited.

You can check on what terminal a process is running (ps -o tty= $pid) and check who last logged in on that terminal (who, last). This is only indicative, though: root can start processes on any terminal.

What do you expect to see if user1 runs su user2 -c 'su user1 -c …'? It's conceivable that the OS would track the successive authentication chains in the kernel data structures associated with the process, but that's very far from the usual unix security model.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.