last command shows a lot of open connections

[Jdamian]

Hi

The 'last' command reports a lot of open connections ('still logged in') but most of them were closed (i.e., they don't exist).

I suspect this behaviour is due to OpenSSH because telnet closed connections appear as closed.

Can anybody help me ?

[Pete Randall]

I have similar issues when users don't properly log out. They use Reflections/X to log into a CDE session and many of the slower learners just click on the little X box, to close the window, rather than exiting properly. This leaves all kinds of process hanging in limbo.

This may or may not be similar to what you're seeing and the only thing I've found to do about it is to patiently explain the proper logout procedure to them over and over again.


Pete

[Cheryl Griffin]

You want to make sure you have the telnet patch installed also for whichever version of the os you are running. The patch lessens these symptoms:
11.11
PHNE_24829 s700_800 11.11 telnet kernel; telnetd(1M); telnet(1) patch

11.00
PHNE_26096 s700_800 11.00 telnet kernel and telnetd(1M) patch
PHNE_14820 s700_800 11.0 telnet(1) patch

If you look at the patch text for these patches you see something similar to:
"4. Incorrect records might be written into /etc/utmpx by telnetd when it exits."

[Zigor Buruaga]

Hi,

I also have similar issues with Exceed. When a user disconnects unproperly, "who" command shows logged users that are not logged on:

# who -u
testuser pts/17 Oct 9 22:18 14:56 12886 xxx.xxx.xxx.xxx:0.0

But running:

# ps -ef | grep 12886
root 17171 16697 3 13:15:54 ttyp3 0:00 grep 12886

shows nothing.

I usually use a little script to detect and remove that ghost_users ( find it attached ).
Maybe you could find it useful ... or maybe I'm talking about other issue different than yours ...

HTH
Kind regards,
Zigor

[Jdamian]

notes:

- ftp and telnet connections are not the problem. They are properly closed. It's OpenSSH.

- 'who' command shows right connections. It is 'last' command that shows the open connections.

[Jdamian]

notes:

- No X server is used to connect to my system. I use Secure CRT. But I found the same behaviour running:

$ ssh peter@`hostname`

After exiting, 'last' command shows as 'still logged in' the closed ssh connection.