I got the right person , look /var/run/utmp holds the entry for the login shells and all the processes in its group . I found it from the windows m/c from where I held a telnet session with the linux m/c and I gave a hard reset to my windows m/c . I booted back on my windows m/c and then had a look at the ps -el and to my surprise I found that the the shells assosciated with the tty line of the earlier terminal still exists not detached but with the older tty line and hence a potential bug.
> -----Original Message----- > From: Ethan Benson [mailto:[EMAIL PROTECTED] > Sent: Tuesday, April 25, 2000 2:06 PM > To: Pat Mahoney > Cc: [email protected] > Subject: Re: user still logged in... > > > On Mon, Apr 24, 2000 at 09:56:10AM -0500, Pat Mahoney wrote: > > The "who" command displays user james as being logged in like this: > > > > pat tty3 Apr 24 09:52 > > james 0 Apr 19 20:24 > > > > User pat is logged in but james logged out sometime on april > 19. Apparently > > though something went wrong and the system stil lists him as > logged in since > > april 19. > > > > James owns no processes and ps aux does not reveal anything suspicious. > > Anyone know how to get rid of user james? > > this is usually caused by a corrupted /var/run/utmp file, i have seen > this happen alot where users show up in who, and users but no in w. > the only way i have found to get rid of these phantom users is to drop > to single user mode and zero out /var/run/utmp (cat /dev/null > > /var/run/utmp) > > I had a problem with this when i was using a 2.7.1 build of rxvt which > was not removing entries properly, i would very soon end up with many > many entries for my user since every time i loged out of X there were > 5 or more rxvts being closed but not removing the utmp entries > right... i have also seen this when ssh connnections are interupted > abnormally. > > -- > Ethan Benson > http://www.alaska.net/~erbenson/ >
