Originally posted by: SystemAdmin

Here is my who list
root pts/1 Nov 30 15:23 0:27 876746 (10.10.3.7)
root pts/2 Nov 30 16:10 . 5587124 (10.10.3.192)
root pts/3 Nov 24 11:42 old 725242 (10.10.3.210)

The AIX 5.3 was shutdown and cold started last Friday, Nov 24 around 11:30 AM for maintenance. I am curious where the third root user (PID 725242) came from? What does it mean "old" in its line activity?
I tried to kill (how do I call the activity, disconnect? force log off?) the unnecessary connected user -- root?
I tried the kill -9 725242, but did not work.

Originally posted by: SystemAdmin

What is the results of ps -ef | grep 725242, what is the process doing. You didn't say what that process was. If it is a ksh, then you should be able to kill it with no problem.

For example these are old processes on my system for a getty that is spawned for the virtual terminal

1. who -l

LOGIN lft0 Jun 18 13:54 old 315552
LOGIN vty0 Jun 18 13:57 old 323764

1. ps -ef | grep 323764

root 323764 1 0 Jun 18 - 60:46 /usr/sbin/getty /dev/console

Check for what is using pts/3

1. ps -ef | grep -e "pts/3"

jwtesch 430080 602144 0 Nov 16 - 0:00 sshd: jwtesch@pts/3

You might see when people logged on with last, and pipe that to still and see more information.

1. last | grep still

Originally posted by: SystemAdmin

Here is the ps -ef | grep 725242

1. ps -ef | grep 725242

root 5496888 5554178 0 16:58:06 pts/2 0:00 grep 725242

1. ps -ef | grep -e "pts/3"

root 5496890 5554178 0 16:59:04 pts/2 0:00 grep -e pts/3

1. last | grep still

root pts/1 10.10.3.210 Nov 27 07:35 still logged in.
root pts/1 10.10.3.210 Nov 26 19:02 still logged in.
root pts/2 10.10.3.210 Nov 24 12:36 still logged in.
root pts/1 10.10.3.210 Nov 24 12:27 still logged in.
root pts/4 10.10.3.210 Nov 24 12:11 still logged in.
root pts/3 10.10.3.210 Nov 24 11:42 still logged in.
But how I kill that?

Originally posted by: SystemAdmin

What do you get with 'who' all by itself? That is the active users and processes. Obviously the processes for your 'old' logins are gone or running as zombies and you won't need to or be able to stop them.

Try
who -d
This may tell you what processes were started at that time and their exit code.

This is unlikely a problem but simply showing the root process that started daemons when the system booted.