'last' reports users logged in erroneously...

'last' reports users logged in erroneously...

Post by Douglas Sant » Thu, 28 Dec 1995 04:00:00



Howdy y'all.  Little question here.  The program 'last' reports users logged in
on TTYs when they have actually logged out.  They have no processes left and
'finger' knows they are gone.  Why isn't utmpx updated?  Where does 'finger'
get its info?  I think 'login' updates these files with new sessions but who
is supposed to update utmpx when a session ends?  inetd cuz it is its child
that died?  It only happens in telnet sessions.  After logging in I tried
a special shell that forked and started a new session/prg-grp to release the
TTY.  The parent exit()s so the TTY should be release and utmpx updated but
the same problem persists.  Any clue?

DJS


 
 
 

'last' reports users logged in erroneously...

Post by Jason R. Mastal » Thu, 28 Dec 1995 04:00:00



Quote:> Howdy y'all.  Little question here.  The program 'last' reports users logged in
> on TTYs when they have actually logged out.  They have no processes left and
> 'finger' knows they are gone.  Why isn't utmpx updated?  Where does 'finger'
> get its info?  I think 'login' updates these files with new sessions but who
> is supposed to update utmpx when a session ends?  inetd cuz it is its child
> that died?  It only happens in telnet sessions.  After logging in I tried
> a special shell that forked and started a new session/prg-grp to release the
> TTY.  The parent exit()s so the TTY should be release and utmpx updated but
> the same problem persists.  Any clue?

There are two things you can do to help this situation.  First, there
exists a patch that fixes /usr/lib/utmpd so wtmpx entries will update
properly.  This is patch #102286-01 (#102287 for x86).

You can also pick up Casper Dik's fixed finger binary from
ftp.fwi.uva.nl in /pub/comp/solaris.

  -- Jason

 
 
 

'last' reports users logged in erroneously...

Post by Davin Mil » Fri, 29 Dec 1995 04:00:00



?
?>Howdy y'all.  Little question here.  The program 'last' reports users logged in
?>on TTYs when they have actually logged out.  They have no processes left and
?>'finger' knows they are gone.  Why isn't utmpx updated?  Where does 'finger'
?>get its info?  I think 'login' updates these files with new sessions but who
?>is supposed to update utmpx when a session ends?  inetd cuz it is its child
?>that died?  It only happens in telnet sessions.  After logging in I tried
?>a special shell that forked and started a new session/prg-grp to release the
?>TTY.  The parent exit()s so the TTY should be release and utmpx updated but
?>the same problem persists.  Any clue?
?
?There are two things you can do to help this situation.  First, there
?exists a patch that fixes /usr/lib/utmpd so wtmpx entries will update
?properly.  This is patch #102286-01 (#102287 for x86).
?
?You can also pick up Casper Dik's fixed finger binary from
?ftp.fwi.uva.nl in /pub/comp/solaris.

Or, simply upgrade to Solaris 2.5

Davin.
-------------------------------------------------------------------------------

               Fax:       (716) 645-3464
               WWW:       http://www.cs.buffalo.edu/~milun/

 
 
 

'last' reports users logged in erroneously...

Post by ron na » Sun, 31 Dec 1995 04:00:00




: ?
: ?>Howdy y'all.  Little question here.  The program 'last' reports users logged in
: ?>on TTYs when they have actually logged out.  They have no processes left and
: ?There are two things you can do to help this situation.  First, there
: ?exists a patch that fixes /usr/lib/utmpd so wtmpx entries will update
: ?properly.  This is patch #102286-01 (#102287 for x86).
: ?
: ?You can also pick up Casper Dik's fixed finger binary from
: ?ftp.fwi.uva.nl in /pub/comp/solaris.

: Or, simply upgrade to Solaris 2.5

I have upgraded to Solaris 2.5, and while last now works, finger is
still broke.  Xterminals that login via xdm cause finger to fail with
"Can't stat /dev/surf16.sdsu" or whatever the name of the xterminal
is...  I've reopen a service call with Sun on this bug.  Does anyone
have any info?  

This feels like a bug with sessreg or how it is called.  One
hint as to the problem is the output of last implies that wtmp was
not updated correctly by sessreg:

mmarcus   pts/11       mx3.sdsu.edu     Fri Dec 29 19:29 - 19:34  (00:04)
le        surf16.sdsu.                  Fri Dec 29 19:29 - 19:38  (00:08)
antonoff  pts/36       CAPS.calstate.ed Fri Dec 29 19:27   still logged in

--

  ,;( )__, )~\|  |
 ;; //   '--;    | Gin-N-Tonic   endurance horse
 '  ;\    |      | Luv on Fire   trusty trail horse

 
 
 

'last' reports users logged in erroneously...

Post by Araya Pamonprawat - PH » Thu, 04 Jan 1996 04:00:00


: Howdy y'all.  Little question here.  The program 'last' reports users logged in
: on TTYs when they have actually logged out.  They have no processes left and
: 'finger' knows they are gone.  Why isn't utmpx updated?  Where does 'finger'

Are there any defunct processes left belonging to those users ?

ps -ef | grep defunct

Have you installed all the recommended patch programs ? There are a
number of sunsites around the world that carry patch programs for many of
the various bugs in Solraris systems.
        sunsite.sut.ac.jp
        sunsite.unc.edu

Sorry, I don't know the answers to your questions, but installing the
recommended patch programs fixed this problem on my machine.

 
 
 

1. last reporting users logged in when they're not

Hi,

When examining last -n 50 I found that about 12 users are still
monitored as being logged in
since April 16. I'm sure they are not. My guess is that this system had
a crash, which indeed occurred that day, at the
very point where /var/adm/wtmp was written. my question is, can we
repair this anyway?
Another question is, can we just overwrite the /var/adm/wtmp and
/var/adm/wtmpx files with
/dev/null without trouble, and start with a fresh /var/adm/wtmp? Should
we HUP something in that case?

Any help would be greatly appreciated

--
/********  ewout Willemse  *********

 ********                  *********/

2. How do I mount a NTFS 5 drive?

3. trouble with 'ftpwho' and reporting logged in ftp users

4. "eth0: RX transfer address mismatch..." - D-Link woe

5. last reports 'crash' at logout

6. Q: How do I install SCO with a NON-IDE CDROM-drive

7. The 'last' command doesn't record users logout

8. Best DX4 notebook?

9. Log All User's Last 100 Commands?

10. Help: problems with 'w', 'who' and 'last'

11. Clearing 'last' log

12. What's 'side effects' of Ksh built-ins?

13. ftp logging with 'last' command