You might want to try "ps -ftpts/30" to see all the processes running there. Its possible someone logged in as someone else then did an su to the ora user.
If it was done via ssh then doing "ps -ef |grep pts/30" ought to show you which sshd process is associated with pts/30.
You can then run "lsof -p <pid> |grep \>" on serverA where <pid> is the process ID revealed for sshd above and \> is literal. You would want to look at lines. This will give you the connection information similar to:
sshd 2483 orauser 3u IPv6 123965389 TCP serverA:ssh->serverB:58712 (ESTABLISHED)
If you then go to serverB and run "lsof |grep "serverA:ssh->serverB:58712" you should find the PID and user in the lsof output from serverB.
Note: serverA:ssh->serverB:58712 is an EXAMPLE only - you would need to figure out what goes there from the output you got from the original lsof.
