topic Non existence process with wrong idle time shown in Operating System - HP-UX

Non existence process with wrong idle time shown

Rita Li — Wed, 01 Aug 2007 05:04:44 GMT

/>w -s|grep xywang
xywang pt311:54 -
/>who -u|grep xywang
xywang pts/tZd Aug 1 09:53 old 7321 10.0.84.252
/>last -R xywang|more
...
xywang pts/tZd 10.0.84.252 Wed Aug 1 09:53 - 10:59 (01:05)
...

In fact this user has already logged out the system but still with the process shown as

xywang pt311:54 -

Also next time whoever login using the terminal
pts/tZd, once logout, this process will then be shown as owned by this user, with the idle time as > 311:54 (seems to me the idle time get accumulated)

Has anyone seen such a scenrio before?

Re: Non existence process with wrong idle time shown

Dennis Handly — Wed, 01 Aug 2007 06:57:18 GMT

This could be due to wtmp files getting corrupted.

You can search ITRC for other issues with wtmp, over 50:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1118377
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1140449

Re: Non existence process with wrong idle time shown

TY 007 — Wed, 08 Aug 2007 23:06:29 GMT

Hi,

Corrupted /var/adm/wtmp file.

To confirm this, perform the following testing:
# cd /var/adm
# cp -p wtmp wtmp.bak
# cat /dev/null > wtmp

Login & Logout some Telnet Sessions & keep monitoring:
# who

Thanks

Re: Non existence process with wrong idle time shown

Juan M Leon — Thu, 09 Aug 2007 11:01:24 GMT

Rita,

You can always try the following

/usr/sbin/acct/wtmpfix

or use

/usr/sbin/acct/fwtmp -ic wtmp

good luck

Re: Non existence process with wrong idle time shown

Rita Li — Wed, 22 Aug 2007 22:33:45 GMT

Tried :-

/var/adm>cp -p wtmps wtmps.bak
/var/adm>cp -p wtmp wtmp.bak
/var/adm>/usr/sbin/acct/fwtmp -ic < /dev/null > wtmps
/var/adm>/usr/sbin/acct/fwtmp -ic < /dev/null > wtmp
/var/adm>ls -aslp wtmp*
0 -rw-rw-r-- 1 adm adm 0 Aug 23 11:23 wtmp
320 -rw-rw-r-- 1 adm adm 158820 Aug 14 16:17 wtmp.bak
32 -rw-rw-r-- 1 adm adm 10432 Aug 23 11:34 wtmps
633936 -rw-rw-r-- 1 adm adm 324566252 Aug 23 11:27 wtmps.bak

However the problem is still not fixed

ie.
/var/adm>w -s|grep ddgong
root pt grep ddgong
ddgong pt231:33 -

Re: Non existence process with wrong idle time shown

Dennis Handly — Thu, 23 Aug 2007 02:37:05 GMT

>However the problem is still not fixed

Are you on 11.23 or later? If so, you need to stick it to the utmpd(1M) demon. ;-)

SIGTERM Perform graceful shutdown.
This causes the daemon to write its in-memory user accounting database to the /etc/utmps file and exit.

Re: Non existence process with wrong idle time shown

Rita Li — Thu, 23 Aug 2007 02:46:43 GMT

Dennis, thanks for the response

Our UX version is

HP-UX bdcimfg1 B.11.23 U ia64 0568256958 unlimited-user license

Can you elaborate more on the steps that should be carried in fixing the problem?

Re: Non existence process with wrong idle time shown

Dennis Handly — Thu, 23 Aug 2007 03:38:26 GMT

>Can you elaborate more on the steps that should be carried in fixing the problem?

First read about utmpd(1M) demon and WARNINGS. There are also comments that say:
There is a time lag which could span from a few seconds on a lightly loaded system to a few minutes on a heavily loaded system.

You have your original backup.

You have already erased the wtmp files.
You can then kill utmpd, the default is SIGTERM.
Make sure you are killing the right process:
# ps -fp $(< /etc/useracct/utmpd_pid )

Then kill it:
# kill $(< /etc/useracct/utmpd_pid )

Then take a look at the wtmp files to confirm they have your bogus user.

Then erase the wtmp files again.
Then restart utmpd:
# /usr/sbin/utmpd