"who" reports user sessions that are no longer active

[Fedon Kadifeli]

In our new Itanium (HP-UX 11.23) server we have a rather serious problem of the system not keeping track correctly the logged out user sessions. For example the "who" command reports user sessions that are no longer active. These sessions where terminated normally using standard exit procedures. Please note the output below:

# who -u | grep bsb71
root pts/4 Oct 6 09:04 0:09 18525 bsb71.abank.com.tr:0.0
root pts/5 Oct 6 09:42 . 25251 bsb71.abank.com.tr:0.0
opc_op pts/6 Oct 6 01:23 8:29 27135 bsb71:0.0
root pts/7 Oct 5 09:12 13:22 13458 bsb71.abank.com.tr:0.0
root pts/8 Oct 5 09:12 13:01 13500 bsb71.abank.com.tr:0.0
root pts/9 Oct 5 20:11 13:24 26028 bsb71.abank.com.tr:0.0
root pts/13 Oct 5 11:57 12:29 12423 bsb71.abank.com.tr:0.0
root dtremote Oct 6 09:02 23:58 18300 bsb71.abank.com.tr:0
# date
Fri Oct 6 09:53:18 EETDST 2006
# ps -ef | grep -e 18525 -e 25251 -e 27135 -e 13458 -e 13500 -e 26028 -e 12423 -e 18300
root 27151 25251 2 09:56:16 pts/5 0:00 ps -ef
root 18329 18300 0 09:02:23 ? 0:00 /sbin/sh -c . //.profile; ^I^I^I unset DT; ############################################################################^J# Ex
root 25211 18525 0 09:42:00 pts/4 0:00 man who
root 18300 18078 0 09:02:22 ? 0:00 /usr/bin/ksh /usr/dt/bin/Xsession
root 27152 25251 0 09:56:16 pts/5 0:00 grep -e 18525 -e 25251 -e 27135 -e 13458 -e 13500 -e 26028 -e 12423 -e 18300
root 25251 25248 0 09:42:32 pts/5 0:00 /sbin/sh
root 18525 18519 0 09:04:14 pts/4 0:00 /sbin/sh

Such a problem is not encountered in the old HP-UX 11.00 systems.

This problem is serious, because for security reasons, we have limited the NUMBER_OF_LOGINS_ALLOWED to a small number in
/etc/default/security file and there are cases when a user cannot login, because this number is exceeded (although no session of that user is active in the system).

Is there a patch available to solve this problem?

Thank you.

[Yang Qin_1]

They are all belongs to "root". Do you logon as "root" directly? Did you configured /etc/securetty? Did you configured a "TIMEOUT=600" in /etc/profile so that an inactive session will be terminated in 10 minutes (in this case)?

[Peter Godron]

Hi,
please see for similar problem:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1065709

Problem should be able to be fixed with wtmpfix ( For details "man wtmpfix )

For details on how accounting works, please see:
man utmp

[Fedon Kadifeli]

Thank you for your answers. However, my problem is not with sessions not terminating or timing out. Sessions (processes) no longer present in the system are displayed as still active by "who". See the following example:

# who -Ru | grep root | grep "Oct 5"
root pts/9 Oct 5 20:11 15:11 26028 bsb71.abank.com.tr:0.0
root pts/13 Oct 5 11:57 14:17 12423 bsb71.abank.com.tr:0.0
# ps -ef | grep -e 26028 -e 12423
root 25327 22223 0 11:40:32 pts/8 0:00 grep -e 26028 -e 12423


I do not want to fix the *tmp files either. I want to get rid of the system bug: As I said before; on systems running 11.00 and having similar usage patterns we do NOT have this problem.

[Peter Godron]

Hi,
have you scanned the latest patches:
PHCO_32641
PHCO_31588
PHCO_31568
.
.
.

From a quick search of 11.23 patches.