Re: WHO Command not working

[Bob Proulx]

Doguparthi, Subramanyam (OpenView SW) wrote:
> On SLES10 x86_64, who command with -b and -t option is not working.

Thank you for your bug report.  I am sure in this case "not working"
means no output but in the future please include exact output
information so that others can debug the problem.

In this case the 'who' command is really just a browser for the
system's utmp file, typically /var/run/utmp, and can only report the
information that is available from that file.  If the information is
in that file then it is reported.  If the file does not contain that
information then there is no information to report.  You might try the
'who --all' and dump everything to see what is there.

  $ who --all

The who command reports information found in the system utmp file.
But updating the contents of the utmp file is the responsibility of
the operating system.  At system boot time the file is initialized and
subsequently kept in sync.  It is not unusual for system events
(e.g. disk full, crashed login shells) to cause this file to no longer
track the actual system state.  I would not use it for ultimate
accuracy.  In my experience it is not a reliable data source.

The utmp file is a very old part of unix-like systems.  I doubt if
today, 30 years later, that it would be implemented the same way that
it was originally implemented bay back then.  Note that the utmp and
wtmp files are running totals kept by various system programs.  Some
programs put things in.  Other programs take things out.  If any
problems arise then the state is out of sync.  Some information is
similar and duplicated from the system's "syslog" file.  There is very
little good use of the utmp file today.  This is as true on GNU/Linux
as it is on HP-UX, Solaris, AIX, etc.

Looking at the documentation for utmp is a good place for further
information.

  $ man utmp

If who is working at all then the utmp file exists and is readable.
Zero sized files, unreadable files, missing files and corrupted files
are the only likely system failure modes.  Sorry to be skeptical but I
doubt the data you are looking for is in the system utmp file and
therefore not there to report.  I suspect that the who command is
working properly and reporting that no boot time or clock change
information is logged in the utmp file.

But the utmp functionality is so unreliable anyway that I recommend
that you look for boot time data elsewhere such as in the kernel
/proc/uptime interface.

Bob