Solaris

Hello, I am running a Solaris 8 system.
I Have encountered that each time I ask the system to report to me the users who have or are about to exceed their quota limit for disk usage, a strange number appears in a user name, it does not appear in my /etc/group or in my /etc/passwd files

The user appears as #833 and as you can see in the report, the number appears as a user, with the # symbol before it
I use: repquota -a | grep EXPIRED

juanma +- 225378 200000 250000 EXPIRED 0 0 0
#883 +- 365479 10000 15000 EXPIRED 11 0 0
felila +- 15007 15000 17000 EXPIRED 0 0 0
aidadia +- 5320 5000 6000 EXPIRED 0 0 0

I've been trying to solve it in several ways, however I can't seem to get it removed.
This is what I've done so far:

I've searched my /etc/passwd for a user called #883, as I've told you, there was no user

I've searched for the user with id 883 in my passwd file, so far, no user has that id number

I've used the command "finger 883" and it returns a bunch of users in the system, however, all of them have their own quotas and none has the id number 883

I've used the command find / -name "833" but it doesn't return any matches.

I've googled the user with and without the # simbol, along with keywords like solaris 8, however, it doesn't return any relevant information sources.

I would really appreciate help, since after all ,as you can see, the user's usage of HD space is growing and it'll be really troublesome.
Any aditional information I'm missing, feel free to tell me, so we can solve this problem. I hope I'm not the first person with this thig.
We think it might be a security breach, so if anyone knows about that, information is welcomed too

Thanks in advance
LZ

Did you have a user id = 833 in the past? That would be my answer.

File information utilities, like quota, use existing system files like passwd to display user id's. If the user has been completely removed, you get the user number in the display.

I think in the past the user might have existed (I'm not the all life administrator :P), however, if the user was removed, why would it be growing his disk usage :-S??
Another thing, I've several users that quota displays as #number
I've used:
repquota -a | grep '#'
and it returnes:
#484 -- 49 5000 6000 10 0 0
#883 +- 365479 10000 15000 EXPIRED 11 0 0
#889 -- 1543 40000 45000 8 0 0
#212 -- 1 10000 15000 1 0 0
#222 -- 1 20000 25000 0 0 0
#227 -- 1 20000 25000 1 0 0
#231 -- 7 20000 25000 1 0 0
#233 -- 1 10000 15000 1 0 0
#301 -- 1 20000 25000 1 0 0
#310 -- 5 20000 25000 1 0 0
#311 -- 1 20000 25000 1 0 0
#344 -- 937 20000 25000 0 0 0
#354 -- 9 20000 25000 1 0 0
#356 -- 1 20000 25000 1 0 0
#440 -- 1 20000 25000 1 0 0
#455 -- 1 20000 25000 1 0 0
#484 -- 1 20000 25000 0 0 0
#485 -- 1 20000 25000 1 0 0
#486 -- 1 20000 25000 1 0 0
#492 -- 1 20000 25000 1 0 0
#622 -- 1 20000 25000 1 0 0
#1069 -- 78 25000 30000 0 0 0
#1075 -- 19344 20000 25000 0 0 0

I'm concerned right now only with #883 because it's the only one growing in size =(

That should be:

Code:

find / -user 883

ok, Thanks man!!!
You've help me solve a problem that had my head spinning quite a lot!!!
It's weird, how can a user have dissapeared from /etc/passwd and still have his files growing in size...
I believe, a previous administrator must've tried to delete the user, but quite stupidly...
Thanks a lot man!!
as root I used the command
find / -user 883
and all files from that user appeared, so I could erase them.
Now I'll try to investigate, why was it still growing...

Erasing the files might not fix the problem. You should first check if the files are not still open by some processes.

True, deleting might not help. You will need to find where the process get spawned from.