RE: WHO Command not working

[Doguparthi, Subramanyam (OpenView SW)]

Hi Bob,

 Thank you for the response.

 Utmp file for system boot time is getting updated on RHEL system but
not on SLES systems. Then I think its SLES who is not updating utmp file
for system boot time.

 Initially we thought of using /proc/uptime to come to know about the
time when the system got booted last. But when the system time is moved
backward or forward, /proc/uptime cannot be used. I am looking for a
source thru which I can get correct boot time even though system time is
changed.


Regards,
Subram

Office -   +91- 80-22052356

-----Original Message-----
From: Bob Proulx [mailto:address@hidden 
Sent: Thursday, July 05, 2007 6:46 AM
To: Doguparthi, Subramanyam (OpenView SW)
Cc: address@hidden
Subject: Re: WHO Command not working

Doguparthi, Subramanyam (OpenView SW) wrote:
> On SLES10 x86_64, who command with -b and -t option is not working.

Thank you for your bug report.  I am sure in this case "not working"
means no output but in the future please include exact output
information so that others can debug the problem.

In this case the 'who' command is really just a browser for the system's
utmp file, typically /var/run/utmp, and can only report the information
that is available from that file.  If the information is in that file
then it is reported.  If the file does not contain that information then
there is no information to report.  You might try the 'who --all' and
dump everything to see what is there.

  $ who --all

The who command reports information found in the system utmp file.
But updating the contents of the utmp file is the responsibility of the
operating system.  At system boot time the file is initialized and
subsequently kept in sync.  It is not unusual for system events (e.g.
disk full, crashed login shells) to cause this file to no longer track
the actual system state.  I would not use it for ultimate accuracy.  In
my experience it is not a reliable data source.

The utmp file is a very old part of unix-like systems.  I doubt if
today, 30 years later, that it would be implemented the same way that it
was originally implemented bay back then.  Note that the utmp and wtmp
files are running totals kept by various system programs.  Some programs
put things in.  Other programs take things out.  If any problems arise
then the state is out of sync.  Some information is similar and
duplicated from the system's "syslog" file.  There is very little good
use of the utmp file today.  This is as true on GNU/Linux as it is on
HP-UX, Solaris, AIX, etc.

Looking at the documentation for utmp is a good place for further
information.

  $ man utmp

If who is working at all then the utmp file exists and is readable.
Zero sized files, unreadable files, missing files and corrupted files
are the only likely system failure modes.  Sorry to be skeptical but I
doubt the data you are looking for is in the system utmp file and
therefore not there to report.  I suspect that the who command is
working properly and reporting that no boot time or clock change
information is logged in the utmp file.

But the utmp functionality is so unreliable anyway that I recommend that
you look for boot time data elsewhere such as in the kernel /proc/uptime
interface.

Bob