Re: wrong output of "who" and "finger"

[Bob Proulx]

Burba, Viktor wrote:
> I have a problem with output from "who" command. As you can see below
> 
> busdm:~ # who -u
> root     pts/0        Nov  2 15:56   .         21861 (192.168.0.20)
> root     pts/6        Jun 18 13:04   ?         15579 (10.11.20.1)
> 
> busdm:~ # uptime
>   4:06pm  up 3 days  2:19,  2 users,  load average: 0.42, 0.30, 0.16
> busdm:~ # date
> Mon Nov  2 16:07:04 CET 2009
> 
> "who" shows me users logged in from Jun18, even so the host has been
> rebooted 3 days ago and today's date of the host is 2nd Nov. Also
> there is no PID 15579. Can you please explain this weird behaviour?

The who command reads the system's utmp file.  This traditionally
existed at /etc/utmp but on modern systems has been moved to
/var/run/tmp.  You can find the actual file on your system by running
who under strace or other system call tracing tool.  Such as:

  $ strace -e file -o /tmp/who.strace who
  $ grep utmp /tmp/who.strace

When users log in, log out, create terminal windows in a graphical
terminal environment (e.g. start an xterm under X windows) the system
records this in the utmp file.  This is a log by "dead-reckoning" and
may become out of sync with reality if the system doesn't track it
correctly.  If a login entry is recorded but no corresponding logout
entry then who will report an entry which isn't really active.  The
who command reports data from that file.  If the data recorded doesn't
make sense then the result from who won't make sense.  GIGO.

It is usually the job of system start up scripts (aka rc scripts) to
set up the utmp file properly at system boot time.  Since the system
may have crashed previously the utmp file may contain stale
information.  At boot time a system script truncates the file to zero,
sets the proper ownership and permissions and prepares it for use.  On
my Debian system this is done in the /etc/init.d/bootmisc.sh script.

It appears that your system isn't properly clearing that file at boot
time.  You didn't say what system you were using.  But regardless the
problem appears to me with your report to be in a problem with the
boot time preparation of the utmp file.

Bob