User login dead in the system

[hangyu]

I found that there are some user login was dead in the system , I try to use kill -9 but still unable to kill the process , and these login are still counted as server login ( the pts is exist ) , can advise except reboot server , how can solve it ? thx

[IT_2007 · Accepted solution]

do you have lsof installed on the system? If so, try to to use with lsof command to see what processess bound to users. Kill it's parent process.

[hangyu]

thx reply,

the below is the who -u output ,

oxt_usr pts/77 Oct 25 08:01 00:01 25875 (192.168.105.158)

can advise how to make use lsof to find the ppid ? thx

[Jim Mallett]

Are you killing the shell? You may just be killing off some child process the user has running.

You've already determined the user in question with your 'who -u'. The result being:
oxt_usr pts/77 Oct 25 08:01 00:01 25875 (192.168.105.158)

To determine the PPID or the shell, you can use pf and grep for the pts:
# ps -ef | grep pts/77

Look under the command column for -sh, that should have the PPID and you should be able to kill -9

Example on my system:
# who -u
jmallett pts/ta Oct 25 00:00 0:01 7225 serverA.domain.com
root pts/0 Oct 24 23:54 . 6819 serverB.domain.com

# ps -ef |grep pts/ta
jmallett 7690 7225 0 00:00:21 pts/ta 0:00 ksh
jmallett 7225 7224 0 00:00:04 pts/ta 0:00 -sh
jmallett 10236 7690 0 00:01:15 pts/ta 0:00 ksh

# kill -9 7225

# who -u
root pts/0 Oct 24 23:54 . 6819 serverB.domain.com


Hope this helps...
Jim

[hangyu]

thx reply,

But I found that the pts/77 is used by another user , it seems the process was dead for long time so another user has used it , can advise what can I do ? thx

[Yang Qin_1]

command "who" uses logs from /etc/utmp together with /var/adm/wtmp. When a user was disconnected abnormally, user will be marked as still logged on but in fact his session has been terminated.

To be sure that user still have some sessions and/or processes left on the server while he is not connected any more, run "ps -fu " and compare the result with the output from "who -u ..."

If your concern is the number of available telnet sessions you can run "ps -ef|grep telnetd|grep -v grep|wc -l", it will tell the number of telnet session alive on that server. The following loop will tell you who has a telnet session on the server now:

for x in `ps -ef|grep telnetd|grep -v grep|awk '{print $2}'`
do
ps -ef|grep $x|grep -vE "grep|telnetd"
done

Yang

[Bill Hassell]

If a process cannot be killed with -9, it is waiting for I/O that will never complete. Since the process is not running, it consumes no resources so you can ignore it. As mentioned, who depends on a clean utmp file and this is difficult to maintain for a number of reasons. Use ps -u to determine if a user is running any processes.