weird result in w command -- double entries.

[Steve Post]

I run "w" to see who is logged on the computer.
I get TWO entries for pts/4.
One user "sybase" logged in on March 28th. The other user "slpost" aka ME, logged in today.

slpost pts/4 9:48am 17 w
sybase pts/4 2:08pm 17 w

What's going on?

[Steve Post]

oh I forgot.
rp4440, hpux11.23 aka 11i version2, running PA-risc.

[Pete Randall]

Steve,

The man page doesn't say what files uptime accesses but I suspect that it must go after /etc/utmp which may be corrupt. Try nulling it out and then retry the command. You won't have duplicates - in fact it will probably show nothing.


Pete

[Peter Godron]

Steve,
possibly a dead session or corruption of /etc/utmp or /etc/wtmp.

Please check thread:
http://forums1.itrc.hp.com/service/forums/bizsupport/questionanswer.do?threadId=597818

[Pete Randall]

By the way, you should probably save a copy of utmp before you null it out!


Pete

[Steve Post]

Well I looked up and followed kbrc0006252. It explained how to use /usr/sbin/acct/fwtmp to make an ascii version of /etc/utmp, to fix it.

It didn't work.

I also see kbrc0016107 talks about using /sbin/utmpd to stop and start...something. But I don't want to reboot the box.

I didn't clear /etc/utmp because I don't want to hurt the box, or reboot it. I see the orignal pts/4 and /pts/5 are users sybase logged in on Mar27-14:36 and Mar28-14:08.
I got that from the "who -H" command.

I ran fctmp to convert these files to text:
/etc/utmp to /tmp/utmp.txt
/etc/utmps
/etc/utmpx
/var/adm/btmp
/var/adm/btmps
/var/adm/wtmp
/var/adm/wtmps

I looked at the ascii version of all of these. I can't find the any strings with:"Mar 27" "Mar 28" "sybase" "pts/4" or "pts/5". It searched in vi which it set to case in-sensitive via (:set -ic) command.

I know the "who -H" command shows two people logged into pts/4 at two different days. I would think that means some type of accounting database is corrupted. But (short of a reboot or wiping out stuff), I can't anything that actually caused the problem, or how to fix it.

So, let me recap:
w, who, who am i, who -h all give erroneous double entries for terminal pts/4 and pts/5. It gets this information from some unknown entity. Let us call it "X". And I know "X" is NOT one of these: /etc/utmp, /etc/utmpx, /etc/uxtmps, /var/adm/wtmp, /var/adm/wtmps, /var/adm/btmp, /varor /adm/btmps.

[Steve Post]

The "file" I have to edit is buried in memory. I can't get to it.

"man utmpd".
I put in a new forum entry about this. It's title is:
"Bug in hpux11.23 /etc/utmp means I have to reboot my box DAILY?"