Users being shown as still logged on

[rhansen]

Hello,

The users are still showing as logged even after logging off. The outputs of "who" and "last" commands vary to a large extent.

Any comments?

Thanks.

[Sp4admin]

Hello,

Some times if a user doesn't logout correctly there session will still show up with the who command. The only way I know to clear it is to reboot which isn't always an option.

sp,

[Pete Randall]

Do they still have active processes running? Run ps -ef |grep "username" to see. If they have no processes then I wouldn't worry about it. If they do, it's a trivial matter to come up with a script to eliminate those processes.


Pete

[James R. Ferguson · Accepted solution]

Hi:

This is not unexpected if your users disconnect from your server by abortively closing (for example) a telnet session running on a PC emulator. In this case, there is no signal to write a logoff record. Usually the missing information is in the 'wtmps' file from which 'last' reads. You can null this file and/or fix it up if you insist. If it is the output of 'who' that is corrupt, the next reboot will cure that.

Problems like this tended to be more prevalent in earlier HP-UX releases; less so, seemingly, in current releases.

Regards!

...JRF...

[Michael Steele_2]

Hi

Your /var/adm/syslog/wtmp file may be corrupt. Sounds like it. Try the wtmpfix command as well as fwtmp.

You should have used fwtmp to read the old file out in ASCII format, removed any spurious entries, and then used fwtmp to rewrite the file in binary format.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=29295

[Dennis Handly]

>The users are still showing as logged even after logging off.

This means HP-UX is broken. What OS version are you using?

>sp: The only way I know to clear it is to reboot which isn't always an option.

Or edit the utmp(4) files.

>Pete: If they have no processes then I wouldn't worry about it.

Unfortunately some scripts won't work if the output of who(1) shows existing processes. :-(

>JRF: This is not unexpected if your users disconnect from your server by abortively

This is completely unexpected if you assume the OS is robust. :-(
It is the OS's job to keep track of resources.

>less so, seemingly, in current releases.

Yes, it seems adding utmpd(1m) has fixed it.

>Michael: Your /var/adm/syslog/wtmp file may be corrupt.

For logged on users, this info is in the utmp(4) files.

[Michael Steele_2]

Thanks Dennis

[Lim Jonhong]

Hi guys,

I have the same problem too, users have not log-off properly or sometime network due to network intermittent. I have "who -q" or "last " and it shows that the user is still logon but ps -ef | grep shows nothing at all.
And because we only allow our user single login (no simultaneous login), this cause them NO LONGER able to login unless we can clear it from the system and the only way is to reboot, or enable multilogin to the userID.
But is there any another way beside that?

[Dennis Handly]

>Lim: I have the same problem too... And because we only allow our user single login... But is there any another way beside that?

You should really create your own thread so you can assign points. It also depends on your OS version.

You can use the "Forums advanced search" to search for my name and utmp under HP-UX.
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1316098
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1378410
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1327311
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1327261
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1227594
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1339685

[Javed Khan_1]

Hi,

If users connections are throuh ssh , i beleive this could be ssh issue.I guess some of the old version of ssh had this kind of problem.

Javed