topic Re: Logout users in Operating System - HP-UX

Logout users

Jeffrey F. Goldsmith — Tue, 14 Mar 2006 17:55:07 GMT

This morning when I was going through my server I noticed that I had some users that had a session open from several days earlier. I contacted them and they said that they were not logged in at the time. I had them login and could see a new session started and then had them logout. Their new session went away but the one that was opened last week was still there. When I check the session it doesn’t show up as being used so I can’t kill it.

How do I get rid of these sessions other than rebooting my server?

HP-UX 11.0

Thanks for the help.

Jeff

Re: Logout users

A. Clay Stephenson — Tue, 14 Mar 2006 18:00:46 GMT

Are these telnet sessions, Oracle sessions, ... ? What command are you using to display them? In many cases, the solution to your problem is killing the parent process (unless it is PPID 1). This could simply be a artifact of whatever utility you are using to display these "sessions" and no process(es) acxtually exist.

Re: Logout users

Rajeev Shukla — Tue, 14 Mar 2006 18:02:22 GMT

Do you see those users in who -u listing?

Re: Logout users

Jeffrey F. Goldsmith — Tue, 14 Mar 2006 18:03:13 GMT

Sorry about the lack of information in the first page. I see these users when I do a "who" at the root prompt.

Re: Logout users

Jeffrey F. Goldsmith — Tue, 14 Mar 2006 18:04:42 GMT

Yes, I do see them when I do a "who -u"

Re: Logout users

Rajeev Shukla — Tue, 14 Mar 2006 18:04:49 GMT

then do a who -u and you will see the proccess ID associated with those users.
You can kill those PID if you are sure that this user is not logged in.

Re: Logout users

Jeffrey F. Goldsmith — Tue, 14 Mar 2006 18:07:24 GMT

I tried that the first time around. This is what I get:

hellickd pts/tN Feb 1 15:07 old 15012 172.16.6.77
root: /home/root ==> kill 15012
kill: 15012: The specified process does not exist.
root: /home/root ==> who -u

Re: Logout users

Rajeev Shukla — Tue, 14 Mar 2006 18:13:00 GMT

You could try killing the parent process if it is not 1 by grep ing..
ps -ef|grep 15012
this will list that user and the parent process..
Try killing that.
If you have lsof installed try seeing the files open by the process

lsof -p 15012

Re: Logout users

A. Clay Stephenson — Tue, 14 Mar 2006 18:17:19 GMT

This is actually an artifact of a corrupt/inaccurate utmp (or wtmp) file and is often caused by users (especially PC users) not cleanly exiting. The processes no longer exist.

One approach would be to use the fwtmp utility to clean up utmp by reading it out in ASCII format, removing the errant entries, and writing it back in binary format. Man fwtmp for details.

A good trick is to send a kill -0 PID to a process. If ${?} is set to 0 then process still exists otherwise, it's bogus.

I suspect that the real answer to this problem is to better educate your users on proper exit procedures.

Re: Logout users

Jeffrey F. Goldsmith — Tue, 14 Mar 2006 18:46:46 GMT

I dont have lsof so that isnt an option. I did a man on fwtmp so i could read up on it. My question is how do I use it?

Is this correct?

/usr/sbin/acct/fwtmp -i wtmp

Re: Logout users

Jeffrey F. Goldsmith — Tue, 14 Mar 2006 19:29:37 GMT

After some websurfing I found some information on how to use fwtmp. This is what I did.

root: / ==> /usr/sbin/acct/fwtmp < /var/adm/wtmp > dummy.file

I looked at the dummy.file but could not find anything that matched the date of the session that was having problems.

Is there something that I am missing?

Re: Logout users

Muthukumar_5 — Tue, 14 Mar 2006 23:22:41 GMT

For killing un-needed sessions then,

# who -Hu

will give username, pid, time and idle informations. With that you can kill the PID from root user.

--
Muthu

Re: Logout users

Muthukumar_5 — Tue, 14 Mar 2006 23:23:55 GMT

To get user login details then,

# last -R

will give it using /var/adm/wtmp file.

--
Muthu

Re: Logout users

Senthil Kumar .A_1 — Wed, 15 Mar 2006 00:09:19 GMT

Hi,

Lets say, u are seeing the sessions of user1. As a root do the following procedure to make the kill those sessions.

# who -u
# su - user1
$ kill -9 -1
# who -u

Note: Doing this will kill even the active session of the user1. In that case, u need to ask the user1 to logout for a while and not launch any program. I do agree with Clay's point aswell, about educating your user community about clean logouts.

Regards,
Senthil Kumar .A

Re: Logout users

Sivakumar TS — Wed, 15 Mar 2006 00:28:10 GMT

Hi Jeff,

# who -u

will display username, pid, time and idle informations.

get the pid of the MOST idle user.

use

#kill -9

this will clear the login.

Regards,

Siva.

Re: Logout users

Jeffrey F. Goldsmith — Wed, 15 Mar 2006 12:24:23 GMT

Muthukumar,

I tried the â who â Huâ and received the following results:

root: / ==> who -Hu
NAME LINE TIME IDLE PID COMMENTS
hellickd pts/tN Feb 1 15:07 old 15012 172.16.6.77
root: / ==> kill 15012
kill: 15012: The specified process does not exist.
root: / ==> kill -9 15012
kill: 15012: The specified process does not exist.

Then I tried the â last â Râ command and received the following error:

root: / ==> last -R
Memory fault(coredump)
root: / ==>

Senthil,

To do the steps you gave me I will need to change the userâ s password so I can login as them. This is going to take some time and will let you know what happens.

Sivakumar,

I have been trying to kill a user that has been out there for over a month. As you can see by the information in this section I can not kill the session because it doesnâ t exist even though it does exist.

Thanks.

Re: Logout users

Carlos Roberto Schimidt — Wed, 15 Mar 2006 12:28:47 GMT

When you have file /var/adm/wtmp too big or corrupted, is possible receive this error message for command "last -R".

If you can:

# cp /dev/null /var/adm/wtmp

Re: Logout users

A. Clay Stephenson — Wed, 15 Mar 2006 12:33:36 GMT

All of these who commands assume the utmp (wtmp,wtmptx) data are correct and they are not. You can't kill a process that doesn't exist and that is your fundamental problem. The solution is to cleanup the utmp files. I would read out the utmp files using fwtmp and then use awk or Perl to extract the PID's. Next send a kill -0 PID

kill -0 ${THISPID}
STAT=${?}
if [[ ${STAT} -ne 0 ]]
then
this is a dead process; don't restore this line when you rewrite utmp
else
this is a good pid; restore this line when you rewrite utmp
fi

Re: Logout users

Victor BERRIDGE — Wed, 15 Mar 2006 12:50:03 GMT

Hi Jeff,
Still looking?
What type of hpux 11.00 ? (PaRisc 1 or 2)
I remembered compiling a tool
If you are interested I will look for it

All the best
Victor

Re: Logout users

Victor BERRIDGE — Wed, 15 Mar 2006 13:23:50 GMT

Compiled on a Kclass 11.00

Looking for the source but unlucky for now
Give it a try - I dont know if it works (used to) because I cant recreate your situation to test, I hope it is what I think (because of its name... fixutmp)