finger idle time

[Steve Lewis]

What does the idle time actually mean as listed by the finger command?

This is an example user who finger says has been idle for 2:13 (command typed at 12:41):
rol793 Rob Long *t6e 2:13 Wed 10:14

He logged in at 10:13 (but finger says 10:14), then ran some programs, one of which is still running:
rol793 27709 27708 0 10:13:46 pts/t6e 00:00 betamenu

that proves that the finger login time isn't exact because it differs by at least 14 seconds.

The last process he spawned is this one:
rol793 3322 3207 0 10:27:25 pts/t6e 00:00 ge_review.4ge

Is finger time calculated from the last time a user spawned a process?
Is it from the last time the user did any terminal i/o ?
What is it?

[Stf]

Hello,

the idle time in finger command is the time since the user doesn't have any activity on the OS.
The idle time is in min or in hour and min if separated with ":", or in days & hour if separated with "d".

Finger time is in hour and min so 10:13:46 = 10:14

I hope this can be helpfull for you...

Stf ;-)

[Pete Randall]

Steve,

Just from the fact that the math is fairly close, I would say it's from the last time the user spawned a process:

12:41 (current time) minus 2:13 (idle time) = (more or less) 10:27 (last process time)

However, there was probably terminal I/O involved in spawning that last process - I'm not sure how you would differentiate between the two.


Pete

[Steve Lewis]

hmmm... operating system interaction. Would that include send() and recv() calls, read() and write() calls or maybe just open() and close()?

He could be doing stuff in that program and I wouldn't know it. That program communicates with a local database through a network tcp socket connection.

If finger gets updated with send() and recv() or read() and write() it means that he did nothing for 2 hours and 13 minutes. If send(), recv(), read() and write() are not monitored, but a fork/exec/fopen is monitored then he could have been doing lots of work and I wouldn't know it.

[Steve Lewis]

Looking at the other thread for killing idle users led me to the who man page. Who -u shows the activity as the tty i/o which is a good indication for me. It comes from utmp, the same as finger, the man page for which was not so clear. I guess tty activity is the one then, unless someone corrects me.