The "who" command is not reporting who is on the system

[Kathy McGohan_1]

The "who" command reports some users, but not all users who are on the system. I can log into this server and type in who, but it does not show that I am logged into this server. I did start a new wtmp file, but it still does not report all those who are on the system.

[A. Clay Stephenson]

When you created the new wtmp file, you threw away data. Basically you replaced one incomplete data set with another. You should have used fwtmp to read the old file out in ASCII format, removed any spurious entries, and then used fwtmp to rewrite the file in binary format.

[James R. Ferguson]

Hi Kathy:

If you login as one user and switch to another ('su newuser') then then only the original user login will be reflected in the 'who' output. You will need to examine '/var/adm/sulog' to see the switch.

If the above doesn't help it would be useful to post the release that you are running.

Regards!

...JRF...

[G. Vrijhoeven]

Hi Kathy,

You could use the ps -uef | grep sh command, to get an overwiew of who is currently on the system.

HTH,

Gideon

[Yogeeraj_1]

hi kathy,

did you try to run finger?

For telnet sessions, it should work. Note that if you want to get information on " users who are on the system", you cannot just rely on who and finger. There are many other protocols through which users can connect to the server.

You may also wish to run netstat (displays statistics for network interfaces and protocols, as well as the contents of various network-related data structures.)

hope this helps too!

kind regards
yogeeraj

[Bill Hassell]

The who command uses the utmp file which can be corrupted by bad applications. utmp is rebuilt at bootup which will solve your problem, but because that file is not well protected and because users trash their sessions rather than properly logging out, utmp corruption is unavoidable. The ps command is the most reliable method to find users on the system.

[Steven E. Protter]

Shalom,

A system restart will clear this issue.

Any time you clear out the information that who uses e.g. wtmp you are going to have this issue.

I try and schedule my > /var/adm/syslog/wtmp for a time when the system has no users.

SEP

[Marvin Strong]

if you need to clean wtmp because it is becoming huge use the fwtmp command as suggested by Mr. Clay it is the clean way to do it.

Depending on system activity, I have a little script that uses fwtmp and runs from cron every 90 or so days. And I keep the last 500 lines or so from the ascii file it created. Then convert that back to wtmp.

[Kathy McGohan_1]

Thanks everyone for all your replies. I was just currious about this problem because one of my coworkers here told me that the Itaniums seem to have this problem right after they get them set up. It doesn't make since to me that they are noted for this.

Our OS version is B.11.23 and we are using SSH Tectia Server 4.4.2.

Finger does not report the right information for everyone. It's way off, but I'll check it out after the server gets rebooted, hopefully someday soon.

Again, thanks for all the replies. Points are coming.

[Douglas Cameron]

Kathy,

If you are a rightfully-so paranoid sysadmin, or have reasonable doubt that there is a security issue, than pull the plug (LAN cable) on the system, reboot in single user mode, and carefully look at the wtmp, utmp, sulog, syslog, maillog, last output, who -b, whodo, and finger output to see who was there and was doing what. If you jave a trusted system with pacct installed, then look at the accounting file and audit trail output as well. Look at your networking and authentication files and compare to backup files to note any and what differences, compare system binaries to MD-5 information, too.

If it is just a general issue, then reboot and look at the general information above without yanking any cables.

Just my opinions.