Need advice on removing 'old' entries listed by 'who -u'

Need advice on removing 'old' entries listed by 'who -u'

Post by Michael Reiche Jakobs » Fri, 20 Dec 1996 04:00:00



Hello world!

Having searched the Info Explorer 'a couple of times' for a method of
of removing these nonexisting entries listed by 'who -u', I have come
to the conclusion that it is not there!

If you have some advice on the trick please give some feedback.

Btw. I'm using AIX 3.2.5 and onwards up to 4.2

Thanks,

Michael Reiche Jakobsen

 - http://www.*net.dk/users/reiche/reiche.htm

 
 
 

Need advice on removing 'old' entries listed by 'who -u'

Post by LAIX Software Consultin » Fri, 20 Dec 1996 04:00:00


Who gets its information from /etc/utmp.  You can use the
fwtmp command to convert the file to a flat text file you
can edit, alter it, and then use fwtmp to convert it back
to it's original form.

Regards,
Paul L.


> Hello world!

> Having searched the Info Explorer 'a couple of times' for a method of
> of removing these nonexisting entries listed by 'who -u', I have come
> to the conclusion that it is not there!

> If you have some advice on the trick please give some feedback.

> Btw. I'm using AIX 3.2.5 and onwards up to 4.2

> Thanks,

> Michael Reiche Jakobsen

>  - http://www.*net.dk/users/reiche/reiche.htm


 
 
 

Need advice on removing 'old' entries listed by 'who -u'

Post by Mark Whetze » Wed, 25 Dec 1996 04:00:00



: Having searched the Info Explorer 'a couple of times' for a method of
: of removing these nonexisting entries listed by 'who -u', I have come
: to the conclusion that it is not there!

: If you have some advice on the trick please give some feedback.

: Btw. I'm using AIX 3.2.5 and onwards up to 4.2

Humm... there were several PTF's to fix this kind of problem with
*PURE* AIX V3 systems, (those without other user installed or net software).  
They have been around for some time.  Several parts of IBM code were not
properly handling interlock update of /etc/utmp.

The REAL problem is that different programs, especially those that
produce 'login' type processsing, such as FTP and others, are not using the
same locking setup that the other IBM programs are (NOW using) to protect
/etc/utmp during updates.

Program A will open utmp, scan for a 'empty' entry, and update it.  Program
B will also start a scan, and find the SAME 'empty' entry.  Program A or B
will write back utmp, trashing the other.  Whowever wrote last won, and
later, when program A/B looks for its entry to clean out, it does not find
it where it expects to find it.  Thus, bogus entries hang around depending on
who last 'rewrote' utmp.

There are several net programs floating around that scan utmp, and attempt
to detect 'defunct' and otherwise corrupt entries, and clean them up.

Look for 'utmpd' and 'utmpclean' as keywords.  I believe that a copy was
at one time in the FAQ files for this newsgroup.

The REAL fix, is to get the authors of the various programs that twiddle
with utmp to get together.  I bet a beer that the way IBM locks utmp is
completely different from the rest of the world would do it, thus they
fight over and lose utmp in the battle.

Later,
markw
--
Mark Whetzel     My comments are my own, not my company's.
Western Geophysical - A division of Western Atlas International Inc.,

VOICE: (713) 963-2544              FAX: (713) 963-2758