who showing old user ...date/time

[boomer_2]

hi guys,
I have a rx4640 with hpux 11i v2 when i run w command i see the following o/p...
I m not able to remove user xyz who is still shown as loggeed by system which is back dated..how doi remove this user from this w command o/p...

User tty login@ idle JCPU PCPU what
tej pts/1 11:55am w
f155 pts/3 11:18am 3 -sh
f1v56 pts/6 11:58am more -s
xyz pts/12 5:23pm399:05 -

[Peter Godron · Accepted solution]

Hi,
check your utmp, wtmp files as they may hold old information.

Please also read:
http://forums1.itrc.hp.com/service/forums/helptips.do?#33 on how to reward any useful answers given to your questions.

[Rasheed Tamton]

Hi,

The file is /var/adm/wtmp
To remove the the xyz user you need to modify the binary file wtmp. Please follow the below procedur.

1-Make a backup copy of your wtmp to wtmp.bkp

2 -Here we are using fwtmp tool to convert the binary wtmp.bkp to text file (wtmp.txt). Be careful about the redirections.

/usr/lib/acct/fwtmp < wtmp.bkp > wtmp.txt

3 - Edit whatever you want in wtmp.txt

vi wtmp.txt
(Remove the xyz user)
4- Convert back the modified wtmp.txt file back to original wtmp

/usr/lib/acct/fwtmp -ic < wtmp.txt > wtmp

You are done.

[Rasheed Tamton]

Hi,

For the currently logged in users, the file is /etc/utmp

Just do the above steps with /etc/utmp

*(always do a backup of the original)

Convert bin to txt
Edit the the txt file
Convert back to /etc/utmp

That is all.

[A. Clay Stephenson]

Fwtmp along with judicious editing will fix the wtmp/utmp entries but you really aren't asking the right question. Who should really never be relied upon to indicate who is on the system. You should really think of the "who" command as nothing more and nothing less than a best guess --- and this applies to all flavors of UNIX. A much more reliable method is to use ps because that does represent a current list of processes.