Re: Problem with who

[Bob Proulx]

address@hidden wrote:
> My problem is that users are showing up the output of who that are not
> logged in.  The output of ps shows that the users reported to be loged in
> by who have no active processes (or orphined processes).  Also, the users
> that the comman w shows differs from who.  The command w shows users that
> have processes that show in ps.

I have seen that problem before too.  It appears to occur when the
processes associated with a terminal are killed in a way that no
update of the /var/run/utmp file can be made.  At that time the system
leaves information dangling there.

The way utmp works is that when a user logs in an entry is made.  When
a user logs out the entry removed.  If something disrupts that process
causing the "removes" to not equal the "adds" then the system will
never deduce this and correct it.  The who program simply prints out
the information from the utmp file.  So whatever information it
contains is what is printed.  The who program really can't do anything
more than this.  This also applies to the other utmp programs such as
finger and w.

If you log in again and again and walk up through the devices an entry
that you have logged into that tty or pty device will be made and will
then clean out the old entry.  Then when you log out it will be
removed.  By that method you can clean up dangling entries.

Bob