How are refreshed the files /etc/utmp

[Bertrand Retif]

The display of 'who' or 'w' commands are based that systems files : /etc/utmp.
who used with option -u should display only the session corresponding to the users connected on the Box.

However it appears sometimes that the result of 'who -u' does not correspond to the reality : some users appear to be connected while there are not. In this case the user appears to be connected but to process is linked to this user.
It happened performing the following :
1 - Check the user connected on the box : `who -u`
user1 pts/40 2:57pm 25 -ksh
user2 pts/41 3:02pm 13 -ksh
2 - kill the process ran by user1 and associated to the user
3 - Check again the user connected : `who -u`
Only user1 is connected while is still referenced in /etc/utmp even if no more process is linked to this.
user1 pts/40
user2 pts/41 3:02pm 13 -ksh

It is like is the tty could not be closed.
This can be an big issue if the tty are not closed because it may prevent users to connect a box as the maximum tty number is reached.

Does someone know how are refreshed /etc/utmp infos files ?
Does someone know how to force a tty to be closed ?
Did someone ever encountered this issue ?

[Cheryl Griffin]

You need to make sure you have the latest telnet patch installed. The patch corrected a issue that could cause utmp corruption.

The /etc/inittab entries can be used to clear the utmp at reboot:
utm1::sysinit:> /etc/utmp utm2::sysinit:> /etc/utmpx

[Bertrand Retif]

Unfortunately, I cannot reboot these boxes frequently and the user almost use ssh to connect the boxes.

[Steven E. Protter]

You have to patch the box to fix this.

Playing with the /etc/utmp area is not something I would recommend, nor will it solve the problem.

Not all patches require a reboot. Get the patches, read the notes and see if you can install them on the fly.

SEP

[Bertrand Retif]

On Solaris, it is possible to use 'pkill' to close a tty.
pkill -t tty

Do you know if any other tool is available for HP ?

Thanks in advance

[Steven E. Protter]

If you can identify the process, you should be able to issue a kill or kill -9 on the process

There should be enough information in /etc/utmp to let you do that.

SEP

[Michael Tully]

We used to have a lot of trouble where people who thought they had logged out hadn't, leaving ttys open. The way we solved our problem was to install patch PHNE_24829 and follow the special instructions associated with it. (Initially mentioned by Cheryl). A simple kill of the process does not fix the problem. (Sorry SEP)

[Sorrel G. Jakins]

I have had problems with an old version of ssh messing with utmp, causing problems with 'last' and 'who'. A simple refresh of ssh cleared up my problems. No reboot was required.