HPUX 11.11 retrieving logged in users

[Mai Ganella]

The commands who and finger are not retrieving all the logged in users. Does anyone know why ?

See example below:
last -100|grep pts/ta
abc pts/ta Mon Sep 15 13:30 still logged in
def pts/ta Mon Sep 15 13:03 - 13:03 (00:00)
ps -ef|grep pts/ta

def 12472 12471 3 09:17:14 pts/tab
abc 21684 21681 0 13:30:08 pts/ta 0:00
who|grep pts/ta
def pts/tab Sep 15 14:00
finger|grep pts/ta

[Robert-Jan Goossens]

Hi Mai,

You could have a corrupt utmp/wtmp file, take a look at next link on how to clear them.

http://www5.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000062909383

Hope it helps,

Robert-Jan

[Zigor Buruaga]

Hi,

Agree with Robert-Jan. Take also a look at the next link:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x7857f4001e965f4cba656053d476329b,00.html

You will find a good recommendation from Bill Hassell.

Kind regards,
Zigor

[Robert-Jan Goossens]

Mai,

Check this doc too, patch PHNE_24829.

http://www5.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000067909350

Regards,

Robert-Jan.

[Mai Ganella]

Thanks for your reply, however your response is identifying another problem which we have had in the past where users not logged in are appearing in the finger or who commands. We fixed this problem by installing patch PHCO-27434.

Our current problem is the converse. Now we have users logged in which are invisible to who and finger.

Should we still apply the patch you suggested to rectify this current problem or is there another solution ?

Thanking you in anticipation,

Mai Ganella

[Steven E. Protter]

My suggestion.

Get your machine current. Pick a Gold Pack you can live with(March, 2003, June, 2003, September 2003) and install it.

Right before the install, do this.

cp /var/adm/syslog/wtmp /tmp
cp /var/adm/syslog/btmp /tmp

cd /var/adm/syslog

> wtmp
> btmp

install the patch pack and reboot.

Then isntall the other ones you have been recommended earlier in this thread.

I'm willing to bet a beer, that unless your system has been seriously compromised, the problem will go away after you follow these steps.

Some users are going to be invisible. Samba(CIFS/9000) users, httpd(web) users will not show up in any of the commands you listed.

SEP