UID 65534 and why is he hanging around in my /run./user/65534, but not to be found there!
Hi
Some service using user nobody…
cat /etc/group | grep 65534
nobody:x:65534
OK thanks,
Good? bad? or…?
Anyway to find which service? OR should I not care about it?
That only shows up on start processes once or twice a week.
Hi
Something not configured right somewhere… it should use /var/lib/nobody a ps -ef should track it down.
there is a LOT of output for that command, and trying to parse through it I can’t find anything related to ‘user nobody’ nor UID65534.
IIRC, this showed up about 3 weeks back, and I can’t think of any changes I made to misconfigure something.
Most people would use grep
ps -ef | grep 65534
and/or
ps -ef | grep nobody
Output for both commands:
~> ps -ef | grep 65534
bill 11561 11535 0 21:58 pts/1 00:00:00 grep --color=auto **65534
**
~> ps -ef | grep nobody
bill 11597 11535 0 21:58 pts/1 00:00:00 grep --color=auto **nobody**
Do I ‘kill’ or hunt down the processes(?) 11561 11535 and 11597 11535
I’m assuming the ‘bill’ is the user, the numbers being processes or process ranges, I know the 21:58 is the time I issued the commands. The rest…???
and I have no idea what ‘–color=auto’ means but that is where 65534 and nobody shows in the output.
Nobody is there and takes down the user slice upon shutdown:
**3400G:~ #** journalctl -b -1 -o short-monotonic --grep 65534
-- Logs begin at Tue 2021-06-15 07:53:08 CEST, end at Thu 2021-06-17 05:41:22 CEST. --
[12173.385749] 3400G systemd[1]: Created slice User Slice of UID 65534.
[12173.387119] 3400G systemd[1]: Starting User Runtime Directory /run/user/65534...
[12173.399622] 3400G systemd[1]: Finished User Runtime Directory /run/user/65534.
[12173.401593] 3400G systemd[1]: Starting User Manager for UID 65534...
[12173.404825] 3400G systemd[23495]: pam_unix(systemd-user:session): session opened for user nobody(uid=65534) by (uid=0)
[12173.569980] 3400G systemd[1]: Started User Manager for UID 65534.
[12173.573495] 3400G su[23437]: pam_unix(su:session): session opened for user nobody(uid=65534) by (uid=0)
[12190.800889] 3400G systemd[1]: Stopping User Manager for UID 65534...
[12190.819455] 3400G systemd[1]: user@65534.service: Succeeded.
[12190.819585] 3400G systemd[1]: Stopped User Manager for UID 65534.
[12190.822895] 3400G systemd[1]: Stopping User Runtime Directory /run/user/65534...
[12190.843354] 3400G systemd[1150]: run-user-65534.mount: Succeeded.
[12190.844008] 3400G systemd[1]: run-user-65534.mount: Succeeded.
[12190.844922] 3400G systemd[1]: user-runtime-dir@65534.service: Succeeded.
[12190.845233] 3400G systemd[1]: Stopped User Runtime Directory /run/user/65534.
[12190.846946] 3400G systemd[1]: Removed slice User Slice of UID 65534.
**3400G:~ #**
Nobody hangs around in its own temporary user directory /run/user/65534.
**3400G:~ #** ll /run/user/
total 0
drwx------ 3 root root 100 Jun 17 05:35 **0**
drwx------ 10 karl users 320 Jun 17 05:40 **1000**
**3400G:~ #**
On my machine the journal shows entries of nobody only during shutdown.
Please try to understand what the ps command does, what grep does and thus what you see. We are not going to tell you to study man pages each and every time, you should know by now.
You see your own users (bill) grep commands running because the strings you ask for are also in the command itself.
There is no need to search for these commands, let alone try to kill them, because they are gone alraedy after the grep is finished.
There are no other lines to interpret, thus at that moment in time there are no processes owned by either nobody or 65534.
I did read the man pages, a 1/2 hour worth of it!
All I am trying to find out is why the instances of /run/user/65534 show up in the start up process, and subsequently ‘starting a session of c1 for nobody’ follows closely behind.
There is not an existing directory named /run/user/65534!
This only started happening about 4 weeks back after an update(back in Leap 15.2).
Sorry to try your patience, I will just have to live with it,
Hi
Look in the journal for that user…
journalctl -b _UID=65534
{To see all field names}
journalctl -b -N
Him not there as as I can see. Thanks for the response.
-- Logs begin at Wed 2021-06-23 11:48:03 CDT, end at Wed 2021-06-23 21:14:36 CDT. --Jun 23 16:48:53 Bill-HP systemd-xdg-autostart-generator[1430]: Configuration file /etc/xdg/autostart/klipper.desktop is marked executable. Please remove executable permission bi>
Jun 23 16:48:53 Bill-HP systemd[1408]: Queued start job for default target Main User Target.
Jun 23 16:48:53 Bill-HP systemd[1408]: Reached target Paths.
Jun 23 16:48:53 Bill-HP systemd[1408]: Reached target Timers.
Jun 23 16:48:53 Bill-HP systemd[1408]: Starting D-Bus User Message Bus Socket.
Jun 23 16:48:53 Bill-HP systemd[1408]: Listening on Multimedia System.
Jun 23 16:48:53 Bill-HP systemd[1408]: Listening on Sound System.
Jun 23 16:48:53 Bill-HP systemd[1408]: Listening on D-Bus User Message Bus Socket.
Jun 23 16:48:53 Bill-HP systemd[1408]: Reached target Sockets.
Jun 23 16:48:53 Bill-HP systemd[1408]: Reached target Basic System.
Jun 23 16:48:53 Bill-HP systemd[1408]: Reached target Main User Target.
Jun 23 16:48:53 Bill-HP systemd[1408]: Startup finished in 905ms.
Jun 23 16:51:13 Bill-HP systemd[1408]: Stopped target Main User Target.
Jun 23 16:51:13 Bill-HP systemd[1408]: Stopped target Basic System.
Jun 23 16:51:13 Bill-HP systemd[1408]: Stopped target Paths.
Jun 23 16:51:13 Bill-HP systemd[1408]: Stopped target Sockets.
Jun 23 16:51:13 Bill-HP systemd[1408]: Stopped target Timers.
Jun 23 16:51:13 Bill-HP systemd[1408]: dbus.socket: Succeeded.
Jun 23 16:51:13 Bill-HP systemd[1408]: Closed D-Bus User Message Bus Socket.
Jun 23 16:51:13 Bill-HP systemd[1408]: pipewire.socket: Succeeded.
Jun 23 16:51:13 Bill-HP systemd[1408]: Closed Multimedia System.
Jun 23 16:51:13 Bill-HP systemd[1408]: pulseaudio.socket: Succeeded.
Jun 23 16:51:13 Bill-HP systemd[1408]: Closed Sound System.
Jun 23 16:51:13 Bill-HP systemd[1408]: Reached target Shutdown.
Jun 23 16:51:13 Bill-HP systemd[1408]: systemd-exit.service: Succeeded.
Jun 23 16:51:13 Bill-HP systemd[1408]: Finished Exit the Session.
Jun 23 16:51:13 Bill-HP systemd[1408]: Reached target Exit the Session.
Jun 23 16:51:13 Bill-HP systemd[1415]: **pam_warn(systemd-user:setcred): function=[pam_sm_setcred] flags=0x8004 service=[systemd-user] terminal=<unknown>] user=[nobody] ruser=<u>**
The first line regarding klipper. It is set to ‘show when relevant’ in the KDE ‘Configure System settings’. I can turn it off, but I don’t really want to eliminate the clipboard.
Configuration file /etc/xdg/autostart/klipper.desktop is marked executable. Please remove executable permission bi>
I set klipper.desktop to be non-executable, and a restart didn’t bring up UID 65534 nor nobody.
I’ll see what happens going forward.
Thanks for all the input! I just wish this old brain would kick in and retain some things.
It’s BACK!! only with a different lline regarding klipper in
journalctl -b _UID=65534
Jun 25 16:46:49 Bill-HP systemd-xdg-autostart-generator[1429]:
/etc/xdg/autostart/klipper.desktop:267: Unknown key name 'TerminalOptions' in section 'Desktop Entry', ignoring.
I’ve only including the first line of the output as the rest of the output is the same as what has been posted before.
I(as root) can’t find any reference to the ‘unknown key TerminalOptions’ in the klipper.desktop properties, nor the number :267: following it in the output above.
When booting after I removed the executable option, it was about 30 second or more faster, and shutdown was way faster.
NOW it is back to slower start and much slower shutdown.
I am at a loss as to what has or is changing with the klipper(clipboard) !
Hi
It’s telling you where the current issue is;
/etc/xdg/autostart/klipper.desktop:267
less the above and check line 267.
I would collect the previous error and this and create a bug report. openSUSE:Submitting bug reports - openSUSE
OK. I will do that.
And thanks, I didn’t even think to equate the 267 number with a line number. You know how this old tired brain works, NOT WELL!
So I root opened the klipper.desktop file and REMOVED the line for “TerminalOptions” restarted, and it is now back to reporting ‘no entries’ for:
sudo journalctl -b _UID=65534
I did this before malcomlewis’s reply, and came back to report the results.
But looking at the system for clipboard, there is one there in YaST.
Can I disable the one in the tray and still have a copy and paste when I need it?
I would collect the previous error and this and create a bug report. openSUSE:Submitting bug reports - openSUSE
Should I do this if this only happens on one of our 4 machines?
The AIO HP , and the laptops don’t have this problem.
Just this old HP DC7700 CMT desktop.
Hi
Up to you… are all other systems the same software etc?
Yes, upgraded from 15.2 to 15.3
the laptops and the HP AIO from the iso dd’d on a usb key.
The(problem machine) HP dc7700 CMT was upgraded using instructions from SDB:System upgrade - openSUSE Wiki
Essientially, I did a ‘zypper dup’, after confirming everything was as it should be.
I went as far as to 'dup the system, I did not pay attention to the BTRFS section as I don’t use it.
BUT! the problem was there in 15.2 before I upgraded this old HP desktop, and the other machine under 15.2 were OK. It happened sometime in late March 2021, after an update that did a lot of things to system files.