ssh client solaris 9; sshd solaris 10 sshd patch SunOS 5.10 Generic 126133-02 Oct 2007 ssh client patch SunOS 5.9 Generic 114356-12 Jun 2007
exiting from a session that lasted for 10-15 minutes causes the client session to hang. exiting within few minutes usually works here is the truss ouput from the master sshd process following the forks. Including only the last stage of the sessions after ctrl-d is pressed OK exit ======= here is the process tree 23645 - master sshd 4208 - forked sshd 4230 - forked sshd 4230: 107.2226 read(9, " ^ D\b\b", 16384) = 4 4234: 107.2228 fcntl(0, F_GETFL) = 8194 FWRITE|FOFFMAX 4234: 107.2230 setpgid(0, 4234) Err#1 EPERM 4230: 107.2230 pollsys(0xFFBFF2B0, 4, 0x00000000, 0x00000000) = 1 4230: fd=4 ev=POLLOUT|POLLRDNORM rev=POLLOUT 4230: fd=5 ev=POLLRDNORM rev=0 4230: fd=6 ev=POLLRDNORM rev=0 4230: fd=9 ev=POLLRDNORM rev=0 4234: 107.2232 ioctl(2, TIOCGSID, 0xFFBFFA94) = 0 4234: 0xFFBFFA94: 4234 4230: 107.2234 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4234: 107.2234 getsid(0) = 4234 4230: 107.2235 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4234: 107.2236 ioctl(2, TIOCSPGRP, 0xFFBFFB40) = 0 4234: 0xFFBFFB40: 4234 4230: 107.2237 write(4, 0x00082588, 48) = 48 4230: FD hFED8C8B8E19C9F V P03 X #A6EB > ` ^E1 #1CA898\r I8BC9 W eC0 h 4230: 96 LF618C2AF8CC3 $E4B9 YFD07FA86 4234: 107.2239 write(2, "\n", 1) = 1 4230: 107.2240 pollsys(0xFFBFF2B0, 4, 0x00000000, 0x00000000) = 1 4230: fd=4 ev=POLLRDNORM rev=0 4230: fd=5 ev=POLLRDNORM rev=0 4230: fd=6 ev=POLLRDNORM rev=0 4230: fd=9 ev=POLLRDNORM rev=POLLRDNORM 4234: 107.2242 _exit(0) 4230: 107.2244 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2245 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2246 read(9, "\r\n", 16384) = 2 4230: 107.2249 pollsys(0xFFBFF2B0, 4, 0x00000000, 0x00000000) = 1 4230: fd=4 ev=POLLOUT|POLLRDNORM rev=POLLOUT 4230: fd=5 ev=POLLRDNORM rev=0 4230: fd=6 ev=POLLRDNORM rev=0 4230: fd=9 ev=POLLRDNORM rev=0 4230: 107.2252 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2253 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2254 write(4, 0x00082588, 48) = 48 4230: S s\n 803A99CB3E6D2 tF78391 W /99 {\0EE _ W10E1 s :961CC0 _ACDC 4230: E6BDCB 0B5 ZC3C3 (84 , 3B2A8EAAF 4230: 107.2256 pollsys(0xFFBFF2B0, 4, 0x00000000, 0x00000000) = 1 4230: fd=4 ev=POLLRDNORM rev=0 4230: fd=5 ev=POLLRDNORM rev=0 4230: fd=6 ev=POLLRDNORM rev=0 4230: fd=9 ev=POLLRDNORM rev=POLLRDNORM 4230: 107.2259 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2260 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2261 read(9, 0xFFBFB318, 16384) = 0 4230: 107.2263 close(9) = 0 4230: 107.2264 pollsys(0xFFBFF2B0, 3, 0x00000000, 0x00000000) = 1 4230: fd=4 ev=POLLOUT|POLLRDNORM rev=POLLOUT 4230: fd=5 ev=POLLRDNORM rev=0 4230: fd=6 ev=POLLRDNORM rev=0 4230: 107.2267 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2268 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2269 Received signal #18, SIGCLD [caught] 4230: siginfo: SIGCLD CLD_EXITED pid=4234 status=0x0000 4230: 107.2270 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2272 sigaction(SIGCLD, 0x00000000, 0xFFBFED80) = 0 4230: old: hand = 0xFF039C88 mask = 0xFFBFFEFF 0x0000FFFF 0 0 flags = 0x0000 4230: 107.2273 write(7, "\0", 1) = 1 4230: 107.2275 setcontext(0xFFBFECA0) 4230: 107.2277 write(4, 0x00082588, 32) = 32 4230: m8DF8D8F79FCF148F031FA0C1 z SC8AFDE L1B ~ J Y10A7 |8303 1 n TD1 4230: 107.2278 pollsys(0xFFBFF2B0, 3, 0xFFBFF368, 0x00000000) = 1 4230: fd=4 ev=POLLRDNORM rev=0 4230: fd=5 ev=POLLRDNORM rev=POLLRDNORM 4230: fd=6 ev=POLLRDNORM rev=0 4230: timeout: 0.100000000 sec 4230: 107.2281 read(5, "\0", 1) = 1 4230: 107.2283 read(5, 0xFFBFF36F, 1) Err#11 EAGAIN 4230: 107.2284 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2286 waitid(P_ALL, 0, 0xFFBFF270, WEXITED|WTRAPPED|WNOHANG) = 0 4230: siginfo: SIGCLD CLD_EXITED pid=4234 status=0x0000 4230: 107.2288 close(8) = 0 4230: 107.2290 stat64("/usr/lib/security/pam_unix_session.so.1", 0xFFBFF058) = 0 4230: d=0x01D80088 i=116635 m=0100755 l=1 u=0 g=2 sz=25712 4230: at = Jul 18 22:52:22 EDT 2008 [ 1216435942 ] 4230: mt = Mar 21 13:59:11 EDT 2008 [ 1206122351 ] 4230: ct = May 20 12:20:34 EDT 2008 [ 1211300434 ] 4230: bsz=8192 blks=52 fs=ufs 4230: 107.2296 pollsys(0xFFBFF120, 1, 0x00000000, 0x00000000) = 1 4230: fd=6 ev=POLLOUT rev=POLLOUT 4230: 107.2298 write(6, "\0\0\0\f", 4) = 4 4230: 107.2299 write(6, "05", 1) = 1 4230: 107.2301 write(6, "FE03\0\0108A # \0\0\0", 11) = 11 4208: 107.2298 pollsys(0xFFBFF328, 2, 0x00000000, 0x00000000) = 1 4208: fd=4 ev=POLLRDNORM rev=0 4208: fd=5 ev=POLLRDNORM rev=POLLRDNORM 4208: 107.2305 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4208: 107.2307 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4208: 107.2308 read(5, 0xFFBFB438, 16384) = 16 4208: \0\0\0\f05FE03\0\0108A # \0\0\0 4208: 107.2311 getuid() = 0 [0] 4208: 107.2312 getuid() = 0 [0] 4208: 107.2314 door_info(3, 0xFFBFEF28) = 0 4208: target=23489 proc=0x2D61C data=0xDEADBEED 4208: attributes=DOOR_UNREF 4208: uniquifier=154299 4208: 107.2319 door_call(3, 0xFFBFEFD0) = 0 4208: data_ptr=FE8E0000 data_size=217 4208: desc_ptr=0x0 desc_num=0 4208: rbuf=0xFE8E0000 rsize=25600 4208: 107.2321 getuid() = 0 [0] 4208: 107.2323 open("/var/adm/utmpx", O_RDWR|O_CREAT, 0644) = 9 4208: 107.2325 open("/var/adm/utmpx", O_RDWR) = 10 4208: 107.2327 fstat64(10, 0xFFBFEB78) = 0 4208: d=0x01D80088 i=294221 m=0100644 l=1 u=0 g=2 sz=51708 4208: at = Jul 18 22:52:22 EDT 2008 [ 1216435942 ] 4208: mt = Jul 18 22:52:22 EDT 2008 [ 1216435942 ] 4208: ct = Jul 18 22:52:22 EDT 2008 [ 1216435942 ] 4208: bsz=8192 blks=102 fs=ufs 4208: 107.2331 fstat64(10, 0xFFBFEA20) = 0 4208: d=0x01D80088 i=294221 m=0100644 l=1 u=0 g=2 sz=51708 4208: at = Jul 18 22:52:22 EDT 2008 [ 1216435942 ] 4208: mt = Jul 18 22:52:22 EDT 2008 [ 1216435942 ] 4208: ct = Jul 18 22:52:22 EDT 2008 [ 1216435942 ] 4208: bsz=8192 blks=102 fs=ufs 4208: 107.2333 ioctl(10, TCGETA, 0xFFBFEB04) Err#25 ENOTTY 4208: 107.2335 read(10, 0x0009121C, 8192) = 8192 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0 s y s t e m d o w n\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\n\0\0\0\0 Y $ H >ACB3\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0D8 4208: 107.2457 lseek(10, 0xFFFFFE8C, SEEK_CUR) = 51336 4208: 107.2459 write(10, 0x0009121C, 372) = 372 4208: r o o t\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: / 1 5 8 p t s / 1 5 8\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0108A\0\b\0\0\0\0\0\0 H81 VEF\0029A 9\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 p some lines deleted 4208: 107.2462 open("/etc/utmppipe", O_RDWR|O_NDELAY|O_NONBLOCK) = 11 4208: 107.2465 write(11, "\0\0\002\0\0108A", 8) = 8 4208: 107.2467 close(11) = 0 4208: 107.2468 close(9) = 0 4208: 107.2469 llseek(10, 0, SEEK_CUR) = 51708 4208: 107.2471 close(10) = 0 4208: 107.2472 open64("/var/adm/wtmpx", O_WRONLY|O_APPEND) = 9 4208: 107.2474 fstat64(9, 0xFFBFF040) = 0 4208: d=0x01D80088 i=294222 m=0100664 l=1 u=4 g=4 sz=61380 4208: at = Jul 18 22:52:31 EDT 2008 [ 1216435951 ] 4208: mt = Jul 18 22:52:22 EDT 2008 [ 1216435942 ] 4208: ct = Jul 18 22:52:22 EDT 2008 [ 1216435942 ] 4208: bsz=8192 blks=120 fs=ufs 4208: 107.2477 write(9, 0xFFBFF13C, 372) = 372 4208: r o o t\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: / 1 5 8 p t s / 1 5 8\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0108A\0\b\0\0\0\0\0\0 H81 VEF\0029A 9\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: 107.2480 close(9) = 0 4208: 107.2481 pollsys(0xFFBFF328, 3, 0x00000000, 0x00000000) = 1 4208: fd=4 ev=POLLRDNORM rev=0 4208: fd=5 ev=POLLRDNORM rev=0 4208: fd=7 ev=POLLOUT rev=POLLOUT 4208: 107.2484 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4208: 107.2486 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4208: 107.2487 write(7, 0x00082588, 16) = 16 4208: \0\0\0\f\nFE\0\0\0\0\0\0\0\0\0\0 4230: 107.2487 pollsys(0xFFBFF120, 1, 0x00000000, 0x00000000) = 1 4230: fd=6 ev=POLLRDNORM rev=POLLRDNORM 4230: 107.2490 read(6, "\0\0\0\f", 4) = 4 4230: 107.2492 read(6, "\n", 1) = 1 4230: 107.2493 read(6, "FE\0\0\0\0\0\0\0\0\0\0", 11) = 11 4230: 107.2495 getuid() = 0 [0] 4230: 107.2497 chown("/dev/pts/158", 0, 0) = 0 4230: 107.2500 chmod("/dev/pts/158", 0666) = 0 4230: 107.2502 close(11) = 0 4230: 107.2503 waitid(P_ALL, 0, 0xFFBFF270, WEXITED|WTRAPPED|WNOHANG) Err#10 ECHILD 4230: 107.2504 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2506 pollsys(0xFFBFF2B0, 3, 0x00000000, 0x00000000) = 1 4230: fd=4 ev=POLLOUT|POLLRDNORM rev=POLLOUT 4230: fd=5 ev=POLLRDNORM rev=0 4230: fd=6 ev=POLLRDNORM rev=0 4230: 107.2508 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2509 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2510 write(4, 0x00082588, 96) = 96 4230: B5C5 j HF0 'AB17CBC4D68A\v8B151386FC DD0 L8ED5AE kF613AF % )CD87 4230: N p91C3A7C0AE /ED RB5B3F593 * - "18FCB9FDFF /\rCA .B59398B5181B 4230: 01FA y05ABC2 p [A89D 4A0 9 CB3 _9D\rB816 "FBA0CD F\t99 r ? ^E9 Z 4230: 107.2518 pollsys(0xFFBFF2B0, 3, 0x00000000, 0x00000000) = 1 4230: fd=4 ev=POLLRDNORM rev=POLLRDNORM 4230: fd=5 ev=POLLRDNORM rev=0 4230: fd=6 ev=POLLRDNORM rev=0 4230: 107.2522 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2523 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2524 read(4, 0xFFBFB3D8, 16384) = 32 4230: 84 2 z - I9C |C412B8C5 19B9B c02 & GB49013CD Y90C4 TCD g Z $DC + 4230: 107.2528 brk(0x00097EB8) = 0 4230: 107.2529 brk(0x00099EB8) = 0 4230: 107.2532 pollsys(0xFFBFF2B0, 3, 0x00000000, 0x00000000) = 1 4230: fd=4 ev=POLLRDNORM rev=POLLRDNORM 4230: fd=5 ev=POLLRDNORM rev=0 4230: fd=6 ev=POLLRDNORM rev=0 4230: 107.2535 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2536 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2537 read(4, 0xFFBFB3D8, 16384) = 0 4230: 107.2538 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2539 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4230: 107.2542 shutdown(4, SHUT_RDWR, SOV_DEFAULT) = 0 ----> I don't see this in the failing case 4230: 107.2543 close(4) = 0 4230: 107.2572 _exit(0) 4208: 107.2576 pollsys(0xFFBFF328, 2, 0x00000000, 0x00000000) = 1 4208: fd=4 ev=POLLRDNORM rev=0 4208: fd=5 ev=POLLRDNORM rev=POLLHUP 4208: 107.2579 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4208: 107.2581 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4208: 107.2582 read(5, 0xFFBFB438, 16384) = 0 4208: 107.2614 Received signal #18, SIGCLD, in pollsys() [caught] 4208: siginfo: SIGCLD CLD_EXITED pid=4230 status=0x0000 4208: 107.2616 pollsys(0xFFBFF328, 1, 0x00000000, 0x00000000) Err#4 EINTR 4208: fd=4 ev=POLLRDNORM rev=0 4208: 107.2623 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4208: 107.2625 sigaction(SIGCLD, 0x00000000, 0xFFBFEDD0) = 0 4208: old: hand = 0xFF039C88 mask = 0xFFBFFEFF 0x0000FFFF 0 0 flags = 0x0000 4208: 107.2627 write(8, "\0", 1) = 1 4208: 107.2629 setcontext(0xFFBFECF0) 4208: 107.2631 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4208: 107.2632 waitid(P_PID, 4230, 0xFFBFF2D0, WEXITED|WTRAPPED|WNOHANG) = 0 4208: siginfo: SIGCLD CLD_EXITED pid=4230 status=0x0000 4208: 107.2635 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 4208: 107.2636 close(5) = 0 4208: 107.2638 close(7) = 0 4208: 107.2639 getpid() = 4208 [23645] 4208: 107.2641 getuid() = 0 [0] 4208: 107.2642 getuid() = 0 [0] 4208: 107.2644 door_info(3, 0xFFBFF060) = 0 4208: target=23489 proc=0x2D61C data=0xDEADBEED 4208: attributes=DOOR_UNREF 4208: uniquifier=154299 4208: 107.2650 door_call(3, 0xFFBFF108) = 0 4208: data_ptr=FE8E0000 data_size=217 4208: desc_ptr=0x0 desc_num=0 4208: rbuf=0xFE8E0000 rsize=25600 4208: 107.2652 getuid() = 0 [0] 4208: 107.2654 open64("/var/adm/wtmpx", O_WRONLY|O_APPEND) = 5 4208: 107.2656 fstat64(5, 0xFFBFF178) = 0 4208: d=0x01D80088 i=294222 m=0100664 l=1 u=4 g=4 sz=61752 4208: at = Jul 18 22:52:31 EDT 2008 [ 1216435951 ] 4208: mt = Jul 18 22:52:31 EDT 2008 [ 1216435951 ] 4208: ct = Jul 18 22:52:31 EDT 2008 [ 1216435951 ] 4208: bsz=8192 blks=122 fs=ufs 4208: 107.2659 write(5, 0xFFBFF274, 372) = 372 4208: r o o t\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0 s s h d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\010 p\0\b\0\0\0\0\0\0 H81 VEF\0031BA2\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 deleted 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 4208: 107.2662 close(5) = 0 4208: 107.2664 shutdown(6, SHUT_RDWR, SOV_DEFAULT) = 0 4208: 107.2666 open("/etc/security/audit_event", O_RDONLY) = 5 4208: 107.2668 fstat64(5, 0xFFBFF0B0) = 0 4208: d=0x01D80088 i=2525 m=0100644 l=1 u=0 g=3 sz=20778 4208: at = Jul 18 22:52:22 EDT 2008 [ 1216435942 ] 4208: mt = Feb 28 10:00:15 EST 2008 [ 1204210815 ] 4208: ct = May 20 12:25:40 EDT 2008 [ 1211300740 ] 4208: bsz=8192 blks=42 fs=ufs 4208: 107.2671 fstat64(5, 0xFFBFEF58) = 0 4208: d=0x01D80088 i=2525 m=0100644 l=1 u=0 g=3 sz=20778 4208: at = Jul 18 22:52:22 EDT 2008 [ 1216435942 ] 4208: mt = Feb 28 10:00:15 EST 2008 [ 1204210815 ] 4208: ct = May 20 12:25:40 EDT 2008 [ 1211300740 ] 4208: bsz=8192 blks=42 fs=ufs 4208: 107.2673 ioctl(5, TCGETA, 0xFFBFF03C) Err#25 ENOTTY 4208: 107.2675 read(5, 0x0008258C, 8192) = 8192 4208: #\n # C o p y r i g h t 2 0 0 7 S u n M i c r o s y s t 4208: e m s , I n c . A l l r i g h t s r e s e r v e d .\n some lines deleted... 4208: 2 ) : n o\n 2 0 5 : A U E _ S E T G I D : o l d s e t g i d ( 4208: 2 ) : p m\n 2 0 6 : A U E _ R E A D L : r e a d l ( 2 ) : n o\n 4208: 2 0 7 : A U E _ R E A D V L : r e a d v l ( 2 ) : n o\n 2 0 8 : 4208: 107.2700 read(5, 0x0008258C, 8192) = 8192 4208: A U E _ F S T A T : f s t a t ( 2 ) : n o\n 2 0 9 : A U E _ D U 4208: P 2 : d u p 2 ( 2 ) : n o\n # A U E _ M M A P i s a p o 4208: t e n t i a l l y v e r y h i g h - v o l u m e e v e n t 4208: , u s e w i t h c a u t i o n\n 2 1 0 : A U E _ M M A P : 4208: m m a p ( 2 ) : n o\n # A U E _ A U D I T i s a p o t e 4208: n t i a l l y v e r y h i g h - v o l u m e e v e n t , 4208: u s e w i t h c a u t i o n\n 2 1 1 : A U E _ A U D I T : a 4208: u d i t ( 2 ) : n o\n 2 1 2 : A U E _ P R I O C N T L S Y S : p 4208: r i o c n t l s y s ( 2 ) : p m\n 2 1 3 : A U E _ M U N M A P : 4208: m u n m a p ( 2 ) : c l\n 2 1 4 : A U E _ S E T E G I D : s e t 4208: e g i d ( 2 ) : p m\n 2 1 5 : A U E _ S E T E U I D : s e t e u 4208: i d ( 2 ) : p m\n 2 1 6 : A U E _ P U T M S G : p u t m s g ( 2 4208: ) : n t\n 2 1 7 : A U E _ G E T M S G : g e t m s g ( 2 ) : n t deleted 4208: M a p p i n g ( 3 X 1 1 ) : x s\n 9 2 0 1 : A U E _ S e t M o d 4208: i f i e r M a p p i n g : X S e t M o d i f i e r M a p p i n g 4208: ( 3 X 1 1 ) : x s\n 4208: 107.2738 read(5, 0x0008258C, 8192) = 0 4208: 107.2740 llseek(5, 0, SEEK_CUR) = 20778 4208: 107.2741 close(5) = 0 4208: 107.2743 auditsys(BSM_AUDITCTL, 0x0000001D, 0xFFBFF360, 0x00000028) = 0 4208: 107.2744 auditsys(BSM_AUDIT, 0x0008A598, 0x00000045, 0xFF06E308) = 0 4208: 107.2746 stat64("/usr/lib/security/pam_unix_session.so.1", 0xFFBFF280) = 0 4208: d=0x01D80088 i=116635 m=0100755 l=1 u=0 g=2 sz=25712 4208: at = Jul 18 22:52:22 EDT 2008 [ 1216435942 ] 4208: mt = Mar 21 13:59:11 EDT 2008 [ 1206122351 ] 4208: ct = May 20 12:20:34 EDT 2008 [ 1211300434 ] 4208: bsz=8192 blks=52 fs=ufs 4208: 107.2761 munmap(0xFE3D0000, 3074) = 0 4208: 107.2763 munmap(0xFE3E2000, 550) = 0 4208: 107.2765 munmap(0xFE3B0000, 5423) = 0 4208: 107.2767 munmap(0xFE3C2000, 771) = 0 4208: 107.2770 munmap(0xFE8C0000, 4458) = 0 4208: 107.2772 munmap(0xFE8D2000, 544) = 0 4208: 107.2775 munmap(0xFE510000, 11701) = 0 4208: 107.2776 munmap(0xFE524000, 944) = 0 4208: 107.2780 munmap(0xFE4F0000, 10076) = 0 4208: 107.2782 munmap(0xFE504000, 1246) = 0 4208: 107.2783 munmap(0xFE4D0000, 14306) = 0 4208: 107.2785 munmap(0xFE4E4000, 1494) = 0 4208: 107.2787 munmap(0xFE4A0000, 129437) = 0 4208: 107.2789 munmap(0xFE4C0000, 7432) = 0 4208: 107.2791 munmap(0xFE480000, 13029) = 0 4208: 107.2792 munmap(0xFE494000, 1592) = 0 4208: 107.2794 munmap(0xFE450000, 125513) = 0 4208: 107.2796 munmap(0xFE470000, 4824) = 0 4208: 107.2798 munmap(0xFE430000, 38927) = 0 4208: 107.2800 munmap(0xFE44A000, 1860) = 0 4208: 107.2805 munmap(0xFE410000, 4669) = 0 4208: 107.2807 munmap(0xFE422000, 980) = 0 4208: 107.2809 munmap(0xFE890000, 53454) = 0 4208: 107.2811 munmap(0xFE8AE000, 5056) = 0 4208: 107.2813 munmap(0xFE850000, 168499) = 0 4208: 107.2815 munmap(0xFE88A000, 14828) = 0 4208: 107.2817 munmap(0xFE390000, 2682) = 0 4208: 107.2821 munmap(0xFE3A2000, 472) = 0 4208: 107.2823 munmap(0xFE380000, 8192) = 0 4208: 107.2830 _exit(1) 23645: 107.2898 Received signal #18, SIGCLD, in pollsys() [caught] 23645: siginfo: SIGCLD CLD_EXITED pid=4208 status=0x0001 23645: 107.2901 pollsys(0xFFBFF3D8, 1, 0x00000000, 0x00000000) Err#4 EINTR 23645: fd=3 ev=POLLRDNORM rev=0 23645: 107.2904 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 23645: 107.2906 waitid(P_ALL, 0, 0xFFBFEDB8, WEXITED|WTRAPPED|WNOHANG) = 0 23645: siginfo: SIGCLD CLD_EXITED pid=4208 status=0x0001 23645: 107.2909 waitid(P_ALL, 0, 0xFFBFEDB8, WEXITED|WTRAPPED|WNOHANG) = 0 23645: siginfo: SIG#0 23645: 107.2911 sigaction(SIGCLD, 0xFFBFEDB8, 0xFFBFEE58) = 0 23645: new: hand = 0xFF039C88 mask = 0xFFBFFEFF 0x0000FFFF 0 0 flags = 0x20002 23645: old: hand = 0x00000000 mask = 0 0 0 0 flags = 0x0000 23645: 107.2914 setcontext(0xFFBFEDA0) 23645: pollsys(0xFFBFF3D8, 1, 0x00000000, 0x00000000) (sleeping...) 23645: fd=3 ev=POLLRDNORM rev=0 failure case ========== master sshd 23645 forked 1492 forked 1519 ksh 1523 1519: 1069.4296 read(9, " ^ D\b\b", 16384) = 4 1519: 1069.4298 pollsys(0xFFBFF2B0, 4, 0x00000000, 0x00000000) = 1 1519: fd=4 ev=POLLOUT|POLLRDNORM rev=POLLOUT 1519: fd=5 ev=POLLRDNORM rev=0 1519: fd=6 ev=POLLRDNORM rev=0 1519: fd=9 ev=POLLRDNORM rev=0 1519: 1069.4301 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1519: 1069.4302 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1523: 1069.4300 ioctl(0, TCGETA, 0xFFBFF5CC) = 0 1523: iflag=0022442 oflag=0014005 cflag=0000277 lflag=0105073 line=0 1523: cc: 003 034 177 025 004 000 000 000 1523: 1069.4304 fcntl(0, F_GETFL) = 8194 FWRITE|FOFFMAX 1519: 1069.4305 write(4, 0x00082588, 48) = 48 1519: Y cC4FC\t ZC5D80E ^ \DD\vE50F031DC0A3 / Q0F U18B0 zBD "A4 @FA1A 1519: TA9 R0E06 p8684 EA1DE8E91 "9A8A 1523: 1069.4306 setpgid(0, 1523) Err#1 EPERM 1523: 1069.4309 ioctl(2, TIOCGSID, 0xFFBFFA94) = 0 1523: 0xFFBFFA94: 1523 1523: 1069.4311 getsid(0) = 1523 1523: 1069.4314 ioctl(2, TIOCSPGRP, 0xFFBFFB40) = 0 1523: 0xFFBFFB40: 1523 1523: 1069.4317 write(2, "\n", 1) = 1 1519: 1069.4317 pollsys(0xFFBFF2B0, 4, 0x00000000, 0x00000000) = 1 1519: fd=4 ev=POLLRDNORM rev=0 1519: fd=5 ev=POLLRDNORM rev=0 1519: fd=6 ev=POLLRDNORM rev=0 1519: fd=9 ev=POLLRDNORM rev=POLLRDNORM 1523: 1069.4320 _exit(0) 1519: 1069.4321 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1519: 1069.4323 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1519: 1069.4324 read(9, "\r\n", 16384) = 2 1519: 1069.4326 pollsys(0xFFBFF2B0, 4, 0x00000000, 0x00000000) = 1 1519: fd=4 ev=POLLOUT|POLLRDNORM rev=POLLOUT 1519: fd=5 ev=POLLRDNORM rev=0 1519: fd=6 ev=POLLRDNORM rev=0 1519: fd=9 ev=POLLRDNORM rev=0 1519: 1069.4329 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1519: 1069.4330 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1519: 1069.4332 write(4, 0x00082588, 48) = 48 1519: u8F92DA9AE78D9F11D713B3FA92 7 D5 sCADB [ U m q PD1F0A2 F049D . 1519: 87 a90 ~14 S1B DE @C9B28E9FD318 1519: 1069.4345 Received signal #18, SIGCLD, in pollsys() [caught] 1519: siginfo: SIGCLD CLD_EXITED pid=1523 status=0x0000 1519: 1069.4347 pollsys(0xFFBFF2B0, 4, 0x00000000, 0x00000000) Err#4 EINTR 1519: fd=4 ev=POLLRDNORM rev=0x2588 1519: fd=5 ev=POLLRDNORM rev=0 1519: fd=6 ev=POLLRDNORM rev=0 1519: fd=9 ev=POLLRDNORM rev=0x722C 1519: 1069.4350 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1519: 1069.4352 sigaction(SIGCLD, 0x00000000, 0xFFBFED58) = 0 1519: old: hand = 0xFF039C88 mask = 0xFFBFFEFF 0x0000FFFF 0 0 flags = 0x0000 1519: 1069.4354 write(7, "\0", 1) = 1 1519: 1069.4355 setcontext(0xFFBFEC78) 1519: 1069.4357 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1519: 1069.4358 waitid(P_ALL, 0, 0xFFBFF270, WEXITED|WTRAPPED|WNOHANG) = 0 1519: siginfo: SIGCLD CLD_EXITED pid=1523 status=0x0000 1519: 1069.4362 close(8) = 0 1519: 1069.4364 stat64("/usr/lib/security/pam_unix_session.so.1", 0xFFBFF058) = 0 1519: d=0x01D80088 i=116635 m=0100755 l=1 u=0 g=2 sz=25712 1519: at = Jul 18 21:25:17 EDT 2008 [ 1216430717 ] 1519: mt = Mar 21 13:59:11 EDT 2008 [ 1206122351 ] 1519: ct = May 20 12:20:34 EDT 2008 [ 1211300434 ] 1519: bsz=8192 blks=52 fs=ufs 1519: 1069.4371 pollsys(0xFFBFF120, 1, 0x00000000, 0x00000000) = 1 1519: fd=6 ev=POLLOUT rev=POLLOUT 1519: 1069.4373 write(6, "\0\0\0\f", 4) = 4 1519: 1069.4374 write(6, "05", 1) = 1 1519: 1069.4376 write(6, "FE03\0\005F3 # \0\0\0", 11) = 11 1492: 1069.4373 pollsys(0xFFBFF328, 2, 0x00000000, 0x00000000) = 1 1492: fd=4 ev=POLLRDNORM rev=0 1492: fd=5 ev=POLLRDNORM rev=POLLRDNORM 1492: 1069.4383 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1492: 1069.4385 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1492: 1069.4386 read(5, 0xFFBFB438, 16384) = 16 1492: \0\0\0\f05FE03\0\005F3 # \0\0\0 1492: 1069.4389 getuid() = 0 [0] 1492: 1069.4391 getuid() = 0 [0] 1492: 1069.4392 door_info(3, 0xFFBFEF28) = 0 1492: target=23489 proc=0x2D61C data=0xDEADBEED 1492: attributes=DOOR_UNREF 1492: uniquifier=154299 1492: 1069.4398 door_call(3, 0xFFBFEFD0) = 0 1492: data_ptr=FE8E0000 data_size=217 1492: desc_ptr=0x0 desc_num=0 1492: rbuf=0xFE8E0000 rsize=25600 1492: 1069.4401 getuid() = 0 [0] 1492: 1069.4403 open("/var/adm/utmpx", O_RDWR|O_CREAT, 0644) = 9 1492: 1069.4406 open("/var/adm/utmpx", O_RDWR) = 10 1492: 1069.4408 fstat64(10, 0xFFBFEB78) = 0 1492: d=0x01D80088 i=294221 m=0100644 l=1 u=0 g=2 sz=51336 1492: at = Jul 18 21:42:22 EDT 2008 [ 1216431742 ] 1492: mt = Jul 18 21:25:17 EDT 2008 [ 1216430717 ] 1492: ct = Jul 18 21:25:17 EDT 2008 [ 1216430717 ] 1492: bsz=8192 blks=102 fs=ufs 1492: 1069.4411 fstat64(10, 0xFFBFEA20) = 0 1492: d=0x01D80088 i=294221 m=0100644 l=1 u=0 g=2 sz=51336 1492: at = Jul 18 21:42:22 EDT 2008 [ 1216431742 ] 1492: mt = Jul 18 21:25:17 EDT 2008 [ 1216430717 ] 1492: ct = Jul 18 21:25:17 EDT 2008 [ 1216430717 ] 1492: bsz=8192 blks=102 fs=ufs 1492: 1069.4414 ioctl(10, TCGETA, 0xFFBFEB04) Err#25 ENOTTY 1492: 1069.4416 read(10, 0x0009121C, 8192) = 8192 1492: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 deleted lines 1492: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 1492: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 1492: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 p 1492: 1069.4543 open("/etc/utmppipe", O_RDWR|O_NDELAY|O_NONBLOCK) = 11 1492: 1069.4545 write(11, "\0\0\002\0\005F3", 8) = 8 1492: 1069.4548 close(11) = 0 1492: 1069.4549 close(9) = 0 1492: 1069.4550 llseek(10, 0, SEEK_CUR) = 49476 1492: 1069.4553 close(10) = 0 1492: 1069.4555 open64("/var/adm/wtmpx", O_WRONLY|O_APPEND) = 9 1492: 1069.4557 fstat64(9, 0xFFBFF040) = 0 1492: d=0x01D80088 i=294222 m=0100664 l=1 u=4 g=4 sz=60264 1492: at = Jul 18 21:42:23 EDT 2008 [ 1216431743 ] 1492: mt = Jul 18 21:25:17 EDT 2008 [ 1216430717 ] 1492: ct = Jul 18 21:25:17 EDT 2008 [ 1216430717 ] 1492: bsz=8192 blks=118 fs=ufs 1492: 1069.4560 write(9, 0xFFBFF13C, 372) = 372 1492: r o o t\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 1492: / 1 4 7 p t s / 1 4 7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 1492: \0\0\0\0\0\005F3\0\b\0\0\0\0\0\0 H81 F7F\003E9\n\0\0\0\0\0\0\0\0 1492: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 deleted 1492: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 1492: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 1492: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 1492: \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 1492: 1069.4563 close(9) = 0 1492: 1069.4565 pollsys(0xFFBFF328, 3, 0x00000000, 0x00000000) = 1 1492: fd=4 ev=POLLRDNORM rev=0 1492: fd=5 ev=POLLRDNORM rev=0 1492: fd=7 ev=POLLOUT rev=POLLOUT 1492: 1069.4568 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1492: 1069.4569 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1492: 1069.4571 write(7, 0x00082588, 16) = 16 1492: \0\0\0\f\nFE\0\0\0\0\0\0\0\0\0\0 1519: 1069.4571 pollsys(0xFFBFF120, 1, 0x00000000, 0x00000000) = 1 1519: fd=6 ev=POLLRDNORM rev=POLLRDNORM 1519: 1069.4574 read(6, "\0\0\0\f", 4) = 4 1519: 1069.4575 read(6, "\n", 1) = 1 1519: 1069.4577 read(6, "FE\0\0\0\0\0\0\0\0\0\0", 11) = 11 1519: 1069.4578 getuid() = 0 [0] 1519: 1069.4581 chown("/dev/pts/147", 0, 0) = 0 1519: 1069.4583 chmod("/dev/pts/147", 0666) = 0 1519: 1069.4585 close(11) = 0 1519: 1069.4586 waitid(P_ALL, 0, 0xFFBFF270, WEXITED|WTRAPPED|WNOHANG) Err#10 ECHILD 1519: 1069.4587 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1519: 1069.4588 pollsys(0xFFBFF2B0, 4, 0x00000000, 0x00000000) = 2 1519: fd=4 ev=POLLOUT|POLLRDNORM rev=POLLOUT 1519: fd=5 ev=POLLRDNORM rev=POLLRDNORM 1519: fd=6 ev=POLLRDNORM rev=0 1519: fd=9 ev=POLLRDNORM rev=0 1519: 1069.4591 read(5, "\0", 1) = 1 1519: 1069.4593 read(5, 0xFFBFF36F, 1) Err#11 EAGAIN 1519: 1069.4594 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1519: 1069.4595 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] 1519: 1069.4596 write(4, 0x00082588, 64) = 64 1519: F8A3C7 :\0 O rE3F8181705 |1B07F51997B783 190B7E9 .8BD5 A T wBBA3 1519: P zA7F0 xE5D6 2 | eB5\tF707 gBE D92E51D vE5ED 7DAD7 ?10\vFE 1AF 1492: pollsys(0xFFBFF328, 2, 0x00000000, 0x00000000) (sleeping...) 1492: fd=4 ev=POLLRDNORM rev=0x722C 1492: fd=5 ev=POLLRDNORM rev=POLLIN|POLLPRI|POLLOUT 1519: pollsys(0xFFBFF2B0, 4, 0x00000000, 0x00000000) (sleeping...) 1519: fd=4 ev=POLLRDNORM rev=0x2588 1519: fd=5 ev=POLLRDNORM rev=0 1519: fd=6 ev=POLLRDNORM rev=0 1519: fd=9 ev=POLLRDNORM rev=0x722C Thnaks for the help. Why two sshd processes are forked for every session? This message posted from opensolaris.org