Removing old connections from who command

[Larry Scheetz]

When I do a who on my 11.i system I show some "old" connections for instance:

lmcquist pts/tv Jul 13 07:56
msmith pts/tU Jul 10 10:47
jbrooks pts/ta Jul 22 15:27
jbrooks pts/tX Apr 17 11:05

I can't find any processes running from these users to kill. How can I get rid of these connections?

Thanks
Larry

[Peter Godron · Accepted solution]

Larry,
from an earlier post:

1. convert the binary wtmp file to an ascii file
# /usr/lib/acct/fwtmp < /etc/wtmp > foo

2. edit the ascii file by using vi editor
# vi foo

3. then restore the ascii file into the binary wtmp file
# /usr/lib/acct/fwtmp -ic < foo > /etc/wtmp

[Robert-Jan Goossens]

Hi Larry,

Title: How to clear corrupted utmp/utmpx files
Document ID: KBRC00008608

http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000080000500

Regards,
Robert-Jan

[Jaime Bolanos Rojas.]

Larry,

Take a look at this thread, is going to help you out.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1040447

Regards,

Jaime.

[spex]

Larry,

It sounds like /var/adm/wtmp is corrupt. But just in case, to make 'who' list pids associated with ttys:

# who -Hu

PCS

[Steven E. Protter]

Shalom Larry,

> /var/adm/wtmp

restart your system.

This will definitely clear things up.

This is not important however. The best thing to do about this is nothing. It is not a security hazard and it does not prevent access.

SEP