who -u showing users PID, I can't find them

[Jonathan Caplette_1]

Hello

I've done a who -u on my server, I've about 60 users logged in, all the same user from different date. All have PID associated to ther login, I can't find them with ps -ef.

The last command return me this:
Invalid record size. Unable to continue ...

I'm running HP-UX 11.23 on rx-6600

Any idea how can I fix this?

regards
Jonathan

[Jeff Schussele]

Hi Jonathan,

What does the whodo command return?
This will give you the PID for their shell session.
A kill -4 will get their shell sessions off the system if they are truly not logged in anymore.

Rgds,
Jeff Schussele

[James R. Ferguson]

Hi Jonathan:

You appear to have two issues.

The first, the 'who -u' is reporting a user who abortively disconnected. That is, instead of gracefully logging off, (s)he simply closed their PC (?) session. Thus there was no indication to write a close event to the 'utmp' log. The solution is to teach your users to close sessions gracefully.

The second issue, with 'last' suggests a corrupted '/var/adm/wtmp' file. I would simply truncate it thusly:

# cat /dev/null > /var/adm/wtmp

Regards!

...JRF...

[Jonathan Caplette_1]

Jeff,

whodo returns only the users, tty, date, no process associate to the users...

[Dennis Handly]

>JRF: The solution is to teach your users to close sessions gracefully.

There is that. But it seems since this keeps coming up, the proper solution would be to ask HP to fix this. ;-) With utmpd(1m), you would think it could monitor enough resources to "fix" the problem.

>'/var/adm/wtmp'

last(1) says it looks at wtmps, so you may have to zero out that one:
> /var/adm/wtmps

>Jeff: A kill -4

Why SIGILL? A kill, or -HUP or -9 would make more sense.

[Jeff Schussele]

Hi Jonathan,

My whodo returns all user/pty specific PIDS in the second column. Bear in mind that column also returns the pty # so *do not* use the entire column output for mass kills. You would definitely kill some PIDs you don't want to.

Hi Dennis,

A stock kill (which is -15) or a HUP are fine.
But a -9 should *only* be used as a kill of last resort.

A kill -15 may not terminate the shell session.
A kill -4 will kill the parent shell - cleanly - and reap all it's children as well.

Back to the actual problem - I agree you have a corrupted wtmp and/or wtmps file.

Rgds,
Jeff Schussele

[Dennis Handly]

>Jeff: A kill -4 will kill the parent shell - cleanly

A SIGILL (Illegal instruction), SIGSEGV and SIGBUS should ONLY be done by the hardware and not by users.

Unless there is a handler for SIGILL in the shell, you will get a core file. This core file will seem like there was something wrong and confuse anyone trying to triage.

[Jonathan Caplette_1]

Thanks everyone... my last command problem is solved...

But I still have a bunch of login that I can't trace back their PID. How can I solve this?

# who -u
monsite pts/0 Sep 11 15:50 . 17609 142.101.252.4
root console Jun 16 11:21 old 1762 system console
jcaplett pts/1 Sep 11 11:11 . 1048 142.101.231.126
monsite pts/2 Sep 11 13:43 2:07 10051 142.101.252.4
monsite pts/4 Sep 11 13:42 2:08 9931 142.101.252.4
monsite pts/5 Sep 11 10:43 5:07 29210 142.101.252.4
monsite pts/7 Aug 17 07:39 old 13530 142.101.252.4
monsite pts/8 Jul 13 01:27 old 23867 142.101.252.4
monsite pts/9 Jul 12 23:51 old 10808 142.101.252.4
monsite pts/10 Jun 21 02:24 old 993 142.101.252.4
monsite pts/11 Jun 21 02:34 old 1637 142.101.252.4
monsite pts/12 Jun 21 02:44 old 1940 142.101.252.4
monsite pts/13 Jun 21 02:54 old 2559 142.101.252.4
monsite pts/14 Jun 21 03:04 old 3184 142.101.252.4
monsite pts/15 Jun 21 03:14 old 3473 142.101.252.4
monsite pts/16 Jun 21 03:24 old 4155 142.101.252.4
monsite pts/17 Jun 21 03:34 old 4788 142.101.252.4
monsite pts/18 Jun 21 03:44 old 5075 142.101.252.4
monsite pts/19 Jun 21 03:54 old 5700 142.101.252.4
monsite pts/20 Jun 21 04:04 old 6320 142.101.252.4
monsite pts/21 Jun 21 04:14 old 6638 142.101.252.4
monsite pts/22 Jun 21 04:24 old 7267 142.101.252.4
monsite pts/23 Jun 21 04:34 old 7886 142.101.252.4
monsite pts/24 Jun 21 04:44 old 8177 142.101.252.4
monsite pts/25 Jun 21 04:54 old 8802 142.101.252.4
monsite pts/26 Jun 21 05:04 old 9430 142.101.252.4
monsite pts/27 Jun 21 05:14 old 9717 142.101.252.4
monsite pts/28 Jun 21 05:24 old 10337 142.101.252.4
monsite pts/29 Jun 21 05:34 old 10958 142.101.252.4
monsite pts/30 Jun 21 05:44 old 11245 142.101.252.4
monsite pts/31 Jun 21 05:54 old 11863 142.101.252.4
monsite pts/32 Jun 21 06:04 old 12503 142.101.252.4
monsite pts/33 Jun 21 06:14 old 12790 142.101.252.4
monsite pts/34 Jun 21 06:24 old 13442 142.101.252.4
monsite pts/35 Jun 21 06:34 old 14072 142.101.252.4
monsite pts/36 Jun 21 06:44 old 14359 142.101.252.4
monsite pts/37 Jun 21 06:54 old 14978 142.101.252.4
monsite pts/38 Jun 21 07:04 old 15600 142.101.252.4
monsite pts/39 Jun 21 07:14 old 16097 142.101.252.4
monsite pts/40 Jun 21 07:24 old 16724 142.101.252.4
monsite pts/41 Jun 21 07:34 old 17353 142.101.252.4
monsite pts/42 Jun 21 07:44 old 17703 142.101.252.4
monsite pts/43 Jun 21 07:54 old 18334 142.101.252.4
monsite pts/44 Jun 21 08:04 old 18954 142.101.252.4
monsite pts/45 Jun 21 08:14 old 19241 142.101.252.4
monsite pts/46 Jun 21 08:24 old 19871 142.101.252.4
monsite pts/47 Jun 21 08:34 old 20503 142.101.252.4
monsite pts/48 Jun 21 08:44 old 20827 142.101.252.4
monsite pts/49 Jun 21 08:54 old 21445 142.101.252.4
monsite pts/50 Jun 21 09:04 old 22072 142.101.252.4
monsite pts/51 Jun 21 09:14 old 22363 142.101.252.4
monsite pts/52 Jun 21 09:24 old 22979 142.101.252.4
monsite pts/53 Jun 21 09:34 old 23606 142.101.252.4
monsite pts/54 Jun 21 09:44 old 23895 142.101.252.4
monsite pts/55 Jun 21 09:54 old 24514 142.101.252.4
monsite pts/56 Jun 21 10:04 old 25142 142.101.252.4
monsite pts/57 Jun 21 10:14 old 25431 142.101.252.4
monsite pts/58 Jun 21 10:24 old 26116 142.101.252.4
monsite pts/59 Jun 21 10:34 old 26738 142.101.252.4


# whodo
Thu Sep 11 15:50:55 EDT 2008
HP-UX
monsite 0 Sep 11 15:50
jcaplett 1 Sep 11 11:11
1048 0:00 sh
1053 0:00 sh
17650 0:00 whodo
17655 0:00 awk
17656 0:00 sort
17658 0:00 awk
17661 0:00 ps
monsite 10 Jun 21 02:24
monsite 11 Jun 21 02:34
monsite 12 Jun 21 02:44
monsite 13 Jun 21 02:54
monsite 14 Jun 21 03:04
monsite 15 Jun 21 03:14
monsite 16 Jun 21 03:24
monsite 17 Jun 21 03:34
monsite 18 Jun 21 03:44
monsite 19 Jun 21 03:54
monsite 2 Sep 11 13:43
monsite 20 Jun 21 04:04
monsite 21 Jun 21 04:14
monsite 22 Jun 21 04:24
monsite 23 Jun 21 04:34
monsite 24 Jun 21 04:44
monsite 25 Jun 21 04:54
monsite 26 Jun 21 05:04
monsite 27 Jun 21 05:14
monsite 28 Jun 21 05:24
monsite 29 Jun 21 05:34
monsite 30 Jun 21 05:44
monsite 31 Jun 21 05:54
monsite 32 Jun 21 06:04
monsite 33 Jun 21 06:14
monsite 34 Jun 21 06:24
monsite 35 Jun 21 06:34
monsite 36 Jun 21 06:44
monsite 37 Jun 21 06:54
monsite 38 Jun 21 07:04
monsite 39 Jun 21 07:14
monsite 4 Sep 11 13:42
monsite 40 Jun 21 07:24
monsite 41 Jun 21 07:34
monsite 42 Jun 21 07:44
monsite 43 Jun 21 07:54
monsite 44 Jun 21 08:04
monsite 45 Jun 21 08:14
monsite 46 Jun 21 08:24
monsite 47 Jun 21 08:34
monsite 48 Jun 21 08:44
monsite 49 Jun 21 08:54
monsite 5 Sep 11 10:43
monsite 50 Jun 21 09:04
monsite 51 Jun 21 09:14
monsite 52 Jun 21 09:24
monsite 53 Jun 21 09:34
monsite 54 Jun 21 09:44
monsite 55 Jun 21 09:54
monsite 56 Jun 21 10:04
monsite 57 Jun 21 10:14
monsite 58 Jun 21 10:24
monsite 59 Jun 21 10:34
monsite 7 Aug 17 07:39
monsite 8 Jul 13 01:27
monsite 9 Jul 12 23:51
root console Jun 16 11:21
1762 0:00 sh


Jonathan

[James R. Ferguson]

Hi (again) Jonathan:

> But I still have a bunch of login that I can't trace back their PID. How can I solve this?

Either reboot, or live with the understanding of how this occured (as discussed). There are records of login sessions and their then-associated pids. Betware that the pid will likely get reused adding to the confusion if you attempt to reference the 'who -u' information.

Regards!

...JRF...

[Jonathan Caplette_1]

Could this clear out the stale logins:

stop utmpd
>/etc/utmp
>/etc/utmps
>/etc/utmpx
start utmpd