Question modifying the ut_type in utmp

[Tod Wiederholt]

I have recently been having problems with a system running HPUX 11.11 where login entries are left in the utmp file. I found several postings regarding this exact issue that appear to resolve the immediate problem. However I have a question about one of the methods that was suggested (this was taken from a recent posting):

----------------------------
Do you mean that the user is still showing as logged in although you know that they are not... That is a common problem. If so, here is the solution:

1. cd /usr/lib/acct
2. ./fwtmp < /etc/utmp > /tmp/utmp
3. edit /tmp/utmp changing 5th column to 8 for ghost user
4. ./fwtmp -ic < /tmp/utmp > /etc/utmp
----------------------------

I would like to know how the system handles entries that have a ut_type entry of 8, more specifically if there are procs still running will they be killed before the utmp entry is removed?

Also, in an attempt to find the root cause, I realize that these "ghost" entries are created when a session is terminated abnomally but if I am setting signal traps in the /etc/profile could this potentially cause a greater number of these? Our environment is a system that has thousands of users that dial into a terminal server, which once connected issues a telnet session to this system. Many of these sessions have the potential for abnormal termination due to the poor stability of async dial connections. One other point, we did not see these "ghost" entries on HPUX 10.20.

Thanks in advance,
TDW

[Michael Bluemm]

Hi Tod,
it's interesting, you've got the same problem like me some months ago.
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x73521012aa92d5118ff10090279cd0f9,00.html
I had them under 10.20, so I'm
not sure about, that it is a 11.11-problem. Perhaps the way of logging-in has changed?
Good luck, be happy, that you had no ghosts til now.
Michael