[sudo-users] troubleshooting with logs

[Fabrice Schuler]

donald.ritchey at exeloncorp.com wrote:
> Depending on the version of UNIX and the characteristics of the startup
> process used, daemon processes may have the console as their controlling
> TTY or they may have null entry, if the O/S updates the TTY information 
> after the daemon disassociates itself from the TTY where it was started.

My mistake : I forgot to precise that this process has not been launched 
from console. To be precise, it was launched from an xterm through a 
telnet connection, and not from the console (I am absolutely sure of 
this point).

> Most daemons started while the system is booted will have the console 
> as their controlling TTY during the startup process.  That is because
> the console terminal is the default output destination of the run control
> programs that boot the system.  As the run control program exits, it closes
> the console, which closes the daemon's terminal as well.  Once the boot 
> scripts or programs complete, the daemon process will then have a null TTY, 
> since it has been effectively disassociated from that terminal.  

Well, indeed, it may be a little more complicated than what I explained 
first. Sorry for that, and for the lack of explanations.

The fact is that I have a daemon (or something like : a process which 
father has been killed after a fork(), and the son is still alive) with 
no tty (sure of that). Every few seconds, this process executes scripts 
through the sudo command.
It is the TTY field of those scripts that were shown on the tty 
"console", and are now sest to "unknown" (which is much better if I have 
well understood Todd's answers).

  > Additionally, if the daemon process is running as the root (or superuser
> ID),
> it may have the ability to open the console terminal for output, if that 
> terminal is 'open'.

I take good notes, but I am sure the console is not "opened", and has 
nearly never been (except for a test I made, which did not change 
anything by the way).

> Best wishes,
> 
> Donald L. (Don) Ritchey


> From:  Todd C. Miller
> 
> Sudo logs the console as "unknown" when the ttyname() function
> returns NULL.  This usually means there is no tty associated with
> the process.

Thank you for this information.
>  
>  - todd


Thank you for all this information, which will be very usefull.

Regards,

Fabrice