/etc/utmp problem

[Noa Harel_2]

Hi all
I have a wired problem:
I installed 36 security patches on 2 HPUX 11 machines.
One is working well. The other is acting a little bit strange: It registers a user in the finger when he loges in - and doesn't delete it when the user loges off.
That reason I need that to work well is that I let the users to open onlt one Telnet session - and I controll that by the "who" list.
HELP Me.
Thanks.

[Pete Randall · Accepted solution]

Perhaps your utmp file is corrupted. You could try recreating it:

# > /etc/utmp


Pete

[Noa Harel_2]

In order to solve this thing I recreate the file all the time. Lately -2-3 times a day.
that solves the problem.. until next time.

[Bill Hassell]

/etc/utmp is somewhat controlled by application programs properly writing to this file. If your users are logging on with PCs, especially using Xwindow emulators, you can expect utmp to become unstable when PCs crash or users do not properly terminate their sessions.

You mayu want to change your control scripting code to use ps rather than who. The ps command has the ability to map a user's session(s) by activating the little-known XPG4 behavior. Try this:

UNIX95= ps -u someuser -H

The -H will show the hierarchy of a login and -u shows only a specific user (or list of specific users.

[Pete Randall]

In that case, I would try going through the swinstall logs for the two machines. It would seem there must have been some difference - some patch got applied on one but not on the other because of a pre-req maybe? If that isn't it, you could review all installed patches to look for differences. That's all we have to go by - the fact that they were behaving the same and now they're not so what's the difference?

Pete

[Carlos Fernandez Riera]

See the patch

PHNE_24829


The code attached ( from Adreas Voss) will help you to recover utmp file.

[Noa Harel_2]

I checked the log of the two systems. They encountered a couple of warnings regarding to the source. but no serious errors.

I checked the difference between the "swlist -l product" - but it's hard to compare the lists - because the hardware is different.

It's possible that the Security application is doing all of this. After all it's a CA software. I'll reinstall it.
Any other suggestions?

[Noa Harel_2]

Carlos,
It seems that all the problems described in this patch are close - but not exactly the same as mine.
And also - I have a pure HPUX 11.0 machine - which is the only system that isn't mentioned in this patch's docs....
How misfortune Am I?

(((:

[Carlos Fernandez Riera]

Sorry my system is 11i.

Search for DocId:

How to clear corrupted utmp/utmpx files DocId: KBRC00008608

[Noa Harel_2]

You know what I just found out?
The user was removed from the list about 25 minutes after he realy logged out.
That means thet the system works but the refresh rate is the problem
I'm trying to dig in.
Also, Helpfull Carlos helped me find a patch that solves this problem.
Hope it would work.
Thanks.

[Noa Harel_2]

You know what I just found out?
The user was removed from the list about 25 minutes after he really logged out.
That means that the system works but the refresh rate is the problem
I'm trying to dig in.
Also, Helpful Carlos helped me find a patch that solves this problem.
Hope it would work.
Thanks.

[Bill Hassell]

Is the user really using telnet and does the user actually exit the shell normally? Or is the user just dumping the telnet window on a PC? telnet protocol has a lot of features that are negotiated between the systems and the connection may not be truly closed as far as telnet is concerned.

[Noa Harel_2]

I use the "exec" on the .profile of the users.
Once the closed the application- they are out of the Telnet session.
Also - they exit the session ok - Not by terminating the session abnormally.
I think this problem has something to do with the refresh time of the last/utmp procedure.