"who" command shows people not actually logged in.

[Kris Banister_1]

I have an HP-UX 11.11 machine that is acting funny.

When I issue the "who" command (and I just had to reboot the machine) it lists people that are not connected to the machine. It shows them all as accessing the machine thru pts/ta.

Any ideas as to what is going on here?

[Ted Ellis_2]

who will normally read the contents of the /etc/utmp file.... check the contents of that file... does it show all of these phantom users?

run this command to see the contents:

strings /etc/utmp

Ted

[Michael Steele_2 · Accepted solution]

This will be corrupted wtmp and/or utmp files. You can go through SAM, routine tasks, trim system files, or you can 'cat /dev/null > /var/adm/wtmp' from the command line.

# cat /dev/null > /var/adm/wtmp

I kinda of like using SAM for this. It's about the only time I ever use SAM. Other system logs can be trimmed at the same time.

Test wtmp and utmp with 'last' and 'finger'.

# last id / account / user

[Keith Bevan_1]

Hi,

Sounds like a corrupt wtmp file.

You can use sam to trim this file to zero, but users will need to be off the system as the file will be in use. Alternatively you can use sam to trim it to a new temporary file.

The easiest solution is to copy a null file over the top of it. eg

cp /dev/null /var/adm/wtmp

This will empty the fileand should clear the problem.

Hope this helps.

Keith

[Steven E. Protter]

Try who -R

Clean out and check permissions on wtmp

SEP