Dead Session can't be killed....

[Christine Feeley]

A firewall between me and my HP9000 11i server has a idle timeout setting that I cannot change. So, if I accidentally go beyond that specified idle time, I get kicked off the server.

When this happens, all my active processes and sessions remain. I am able to clean out all my "dead" processes using the "kill" command. However, I do not know how to remove the dead sessions that appear in "whodo". Some of them are 1 month or older.

I have seen some scripts that people use to update the who source file....is the is the only wya to get rid of these sessions? Is there not a command like "kill" to use for these dead session.

[Pete Randall]

Christine,

Usually, an "un-killable" process is waiting on the completion of a request - like an I/O request, for example. Until the I/O request completes and the process wakes up, it is unable to receive and respond to the kill signal. As a general rule, the only way to get rid of these processes is to reboot the server.


Pete

[Kevin Wright]

I assume these processess are owned by init, or PID 1. They are probably unsignable, do a ps -elf, is the PRI between 148-152, if so, you cannot send it a signal through the kernel.

[Dario_1]

Hi!

You will have to reboot the machine to be able to kill them.

Regards,

Dario

[Steven E. Protter]

Attaching a script. If it can't kill it nothing can. Try it then reboot.

It won't search by user id root.

For obvious reasons.

SEP

[V. Nyga]

Hi,

I don't know the command "whodo", but I think it bases at "who".
I think here is a similar thread about that, and I did what Frank mentioned. But after some days the same occures. So you should have to update 'the who source file' (/etc/umtp) every time you are kicked off the server. Or let the dead sessions till the next reboot ...
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x82ede822e739d711abdc0090277a778c,00.html

Regards
Volkmar

[Brian Bergstrand]

I've seen this before, where a user was not logged in, but w (who) showed they were. Turned out that somehow a login/getty process was attached the terminal the user had been assigned in a previous sesssion. I killed this and the phantom session disappeared as well.

You'll be able to find this process with a
ps -u .

HTH.

[Zigor Buruaga]

Hi,

It seems you have ghost users, you can see them with "whodo" but that users are not logged on.

Try this:

cd /usr/lib/acct

./fwtmp < /etc/utmp > /tmp/utmp

edit /tmp/utmp changing 5th column to 8 for ghost user

./fwtmp -ic < /tmp/utmp > /etc/utmp

Regards,
Zigor

[Robert-Jan Goossens]

Hi,

looks to me like wtmp and utmp are corrupt, if it is possible try cleaning them. there is a document on the itrc.

Date: 12/10/01
Document description: How to clear corrupted utmp/utmpx files
Document id: KBRC00008608

http://www4.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000062909383

otherwise remove them and reboot.

Hope it helps,

Robert-Jan.