Unable to remove the idle user

[Unable to clear the idl]

here,
zzz123 - user1
yyy123 - user2

# who -u
zzz123 pts/0 Nov 10 22:31 0:14 17959 143.5.80.154
zzz123 pts/1 Nov 10 22:35 . 18152 143.5.80.154
yyy123 pts/2 Nov 10 22:39 old 18184 143.24.14.81
yyy123 pts/3 Nov 10 22:42 1:37 18235 143.24.14.81

______


# ps -eaf |grep -i zzz123
root 11129 10773 0 08:02:40 pts/1 0:00 grep -i zzz123

# ps -eaf |grep -i 17959
root 11131 10773 0 08:02:48 pts/1 0:00 grep -i 17959

# ps -eaf |grep -i yyy123
root 11133 10773 0 08:02:54 pts/1 0:00 grep -i yyy123

# ps -eaf |grep -i 18184
root 11139 10773 0 08:03:04 pts/1 0:00 grep -i 18184

________________
Unable to find the users process on ps -eaf ,which listed on who -u cmd....Kindly some one suggest us to clear this user from who command.

Thanks in advance....

[Dennis Handly]

There are a bunch of threads on wtmp corruption like this:
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1268078

[Jaime Bolanos Rojas.]

Hi,

Try using lsof utility ( list open files ) to find out what are the files/process that is own by those users.

Regards,

Jaime.

[Unable to clear the idl]

There is no process utilized on lsof..for that users...


And Dennis..that link doesn't cleared my problem...

[OldSchool]

take another look at Dennis' link. Did you actual clear out the files noted? (see the last couple of items in particular).

that, or a reboot is the only way to fix this. the users aren't logged in, the files are corrupted as they either didn't log out correctly or were abrubtly killed.

[PJoshi]

Can we use fuser or cfuser to findout the processes associated with this device (pts/1 or whatever) associated with that login...?

Not sure, this is just a thought...

Haven't tried this but tried to unmount a file system which work very well.

[OldSchool]

if you look at the output "ps...grep username" of the original post, you will note that the user *is'nt* logged in, and doesn't have processes running.

the problem is that the files used to track logins / logouts has been corrupted. the fix has been noted above.

i see no method by which unmounting a file system would help.

[Dennis Handly]

>Jaime: Try using lsof utility

I suggest you look at the other links and search the forums. These are bogus users that aren't there any more.

>that link doesn't cleared my problem.

Sure it does. You need to look at the 10s of other links like it. You may need to nuke all of those /etc/utmp* files before you can get it cleaned up.
/etc/utmpx and /etc/utmps and maybe stop utmpd(1m).

>PJoshi: Can we use fuser or cfuser to find out the processes

Read carefully. The users are NOT there. The who(1) database is corrupted.

[Dennis Handly]

>that link doesn't cleared my problem

It might help if you listed what you did, or planned to do.
That link has N different suggestions and probably only the last works.

Also what HP-UX version do you have?

[Jaime Bolanos Rojas.]

Dennis, I did yesterday, after you posted it, it was a good call and I learn from the other post.

Thanks!

Jaime.