need script to count how many uid's

[lpblauen]

I need to run a script to count how many uid's are say nobody and when there are more than 5 nobody ids running to alert me. I thought ps -u nobody | wc -l would work but I get a false number. I did it for root and it tells me there are more:
ps -ef | grep root | grep -v grep | wc -l
47

ps -fu root | wc -l
69

when I manually count there are only 47 root uid's running
using the ps -ef | pg command...
Help please.....

 

[columb]

who | grep nobody | wc -l

Columb Healy

 

[Annihilannic]

Out of curiosity, what does ps -fU root | wc -l give you?

-u uses effective UID, -U uses "real" UID.

Annihilannic.

 

[Mike042]

There are several possibiliites you could try:

ps -ef | grep nobody | grep -v grep | wc -l
or
ps -ef | grep -v grep | grep -c nobody
or
ps -ef | grep -c nobod[y]

I hope that helps.

Mike

 

[lpblauen]

Annihilannic how you doing long time. Any way here are the results of verious attempts.
>ps -ef | grep root | wc -l
43
>ps -furoot | wc -l
64
>ps -fU root | wc -l
64
>
As you can see I get different counts. I finally came up with a way to get a good count. Here is the script I came up with.

#!/usr/bin/ksh
# script by L Blauen to notify us if there are to many cyborg
# processes running on the system. 1/04/2006 version 1.0
#set -x # to see what script is doing step by step uncomment
rm -f /tmp/list # this removes the temp file before creating the new one
rm -f /tmp/pc # we remove the old count
a=cyborg # change this to the id you want to find
#a=root # this is the test id
# this makes a temp file to count from
ps -ef >>/tmp/list
# here we get the count of processes
n=`awk '{print $1}' </tmp/list | grep $a | wc -l`
# this is to see the count for testing only
#echo $n
# here we create the daily log of cyborg processes
echo "Number of cyborg processes" $n at `date +"%r %a %d %h %y"` >>/syslog/daily
# here we set the threshold for the count
if (( $n >100 ))
then
echo " We have too many "$a" process running there are"$n" running">/tmp/pc
# here we will send an email alert to someone.
# we will setup a alias with names of who should
# be alerted. that will be done in /etc/aliases
# sendmail -s "cyborg processes" unix </tmp/pc
# this is to see the count when running manually
cat /tmp/pc
else
echo " We have "$n" "$a" process running"
fi

 

[Annihilannic]

Doing well thanks Lloyd, and you?

That's very strange... what sort of processes are listed by ps -fu root but not by ps -ef | grep root? Can you post examples please?

I guess you're probably doing this on AIX?

Annihilannic.

 

[lpblauen]

Yes I'm using aix 5.2.0.4 I don't know what the difference in ps -ef ver ps -fu is thats why the question.
here is a snap of ps -ef | grep root there are 45 process
I'll show just the top few
root 1 0 0 Dec 14 - 1:48 /etc/init
root 3656 1 0 Dec 14 - 78:00 /usr/sbin/syncd 60
root 5212 1 0 Dec 14 - 0:00 /usr/lib/errdemon
root 5862 20412 0 Dec 14 - 0:00 /usr/sbin/rsct/bin/IBM.DRMd
root 6990 1 0 Dec 14 - 0:00 ./mflm_manager
root 7316 1 0 Dec 14 - 5:30 /usr/sbin/getty /dev/console
root 7740 1 0 Dec 14 - 0:00 /usr/ccs/bin/shlap
root 8500 20412 0 Dec 14 - 0:00 /usr/sbin/rsct/bin/IBM.ServiceRMd
root 9308 20412 0 Dec 14 - 0:00 /usr/sbin/rsct/bin/IBM.AuditRMd
root 9816 20412 0 Dec 14 - 0:00 /usr/sbin/rsct/bin/IBM.ERrmd
root 10116 20412 0 Dec 14 - 0:29 /usr/sbin/rsct/bin/rmcd -r
root 10386 20412 0 Dec 14 - 0:19 /usr/sbin/rsct/bin/IBM.CSMAgentRMd
root 11528 20412 0 Dec 14 - 0:00 /usr/sbin/rsct/bin/IBM.HostRMd

This is ps -fu root shows me 67 processes again I'll show the top few.
UID PID PPID C STIME TTY TIME CMD
root 0 0 120 Dec 14 - 1:33 swapper
root 1 0 0 Dec 14 - 1:48 /etc/init
root 516 0 120 Dec 14 - 30945:40 wait
root 774 0 120 Dec 14 - 30788:37 wait
root 1032 0 62 Dec 14 - 0:00 reaper
root 1290 0 0 Dec 14 - 8:04 lrud
root 1548 0 0 Dec 14 - 0:00 xmfreed
root 1806 0 0 Dec 14 - 0:01 pilegc
root 2064 0 0 Dec 14 - 0:07 xmgc
root 2322 0 0 Dec 14 - 0:05 netm
root 2580 0 0 Dec 14 - 3:48 gil
root 2838 0 0 Dec 14 - 0:00 wlmsched
root 3656 1 0 Dec 14 - 78:00 /usr/sbin/syncd 60
root 3888 0 0 Dec 14 - 0:00 dog
root 4200 1 0 Dec 14 - 0:00 usbCfgDev
root 4406 0 0 Dec 14 - 0:00 jfsz
root 4962 0 0 Dec 14 - 0:00 lvmbb
root 5212 1 0 Dec 14 - 0:00 /usr/lib/errdemon
root 5862 20412 0 Dec 14 - 0:00 /usr/sbin/rsct/bin/IBM.DRMd
root 6016 0 0 Dec 14 - 0:00 kbiod
root 6304 0 0 Dec 14 - 0:00 rtcmd
root 6990 1 0 Dec 14 - 0:00 ./mflm_manager
root 7316 1 0 Dec 14 - 5:30 /usr/sbin/getty /dev/console
root 7740 1 0 Dec 14 - 0:00 /usr/ccs/bin/shlap

It looks like ps -fu shows hidden processes and ps -ef dos not.

 

[p5wizard]

ps -uroot shows all root processes, including kernel processes

ps -ef shows only non-kernel processes

hence your difference.

You might try ps -efk|grep root instead of ps -ef|grep root and compare to ps -furoot.

HTH,

p5wizard