13

I'm trying to run command lsof |grep services on my Solaris 10 to find any processes that have big files which are using up the disk space but i got a bunch of lines saying:

lsof: no pwd entry for UID 105

I looked at /etc/passwd but there's no user with UID 105 (I think this user was deleted).

What is the lsof line above indicating?

Improve this question

1 Answer 1

Reset to default
10

I looked at /etc/passwd but there's no user with UID 105 (I think this user was deleted).

That's what the lsof output is indicating. There's a process running owned by UID 105, but when it tried to lookup the username, there's no entry for that UID in /etc/passwd. Most likely the process was started before the user was deleted, and has been running ever since.

Improve this answer
7
  • ... or the user created a setuid program somewhere other than his home directory, and somebody ran it.
    – Scott - Слава Україні
    Apr 2, 2015 at 3:45
  • and how can i find the process running by UID 105? I think it's the reason that causes the main problem where df reports 97% disk usage but du only reports half of it.
    – Tom
    Apr 2, 2015 at 13:38
  • @Tom ps -U 105 and ps -u 105 for UID and EUID, respectively
    – Michael Mrozek
    Apr 2, 2015 at 14:33
  • @MichaelMrozek I did but they both show me unknown user 105.
    – Tom
    Apr 2, 2015 at 16:26
  • 60
    Can also be due to processes running in a container, like docker, that have that UID. The warning can be silenced with the -w option.
    – Tim Bunce
    Nov 10, 2015 at 20:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .