who/finger shows user logged in but user really isn't

[Boyd Kodama]

For the past few months, I have noticed on our systems (HPUX 10.20, series 700)
that `who` or `finger` may occasionally show a user logged into a system but that
user is really not logged in. I do a `ps -deaf | grep ` and no output
comes back. So, the user is not running any processes like csh.

However, if the system is rebooted, the "lingering" login is finally gone.

Any ideas why this may be?

If I find another "lingering" login (which currently one of our systems has),
what, as root, can I do to remove it?

Actually, my ultimate question of this situation is what is happening or
not happening that a user still shows up from `who` or `finger` although that
user has logged out and has not executed some background or nohup process.

thank you,

BK

[John Palmer · Accepted solution]

This question was asked recently. Have a look at:-

http://my1.itrc.hp.com/cm/QuestionAnswer/1,1150,0x6ff86c96588ad4118fef0090279cd0f9,00.html

Regards,
John

[James R. Ferguson]

Boyd:

'who' actually examines /etc/utmp for its information. If that file isn't exactly correct then you can get the results you have seen. See the man pages for 'who' for more information.

...JRF...