strange /usr/ucb/w output

strange /usr/ucb/w output

Post by Brett J. Hero » Tue, 24 Mar 1992 15:15:19



This is the pertinent part of the "w" output:

$w
  5:25pm  up 5 days,  6:43,  9 users,  load average: 8.92, 8.06, 6.89

someone  ttyp5    Thu 9am 2days                -

I should add that "ps" shows no ttyp5 or someone processes.

I tried "chown root /dev/ttyp5; chgrp root /dev/ttyp5" (they did the changes)
But, the same "w" output still... What's going on here?


 
 
 

strange /usr/ucb/w output

Post by John Navar » Tue, 24 Mar 1992 16:59:24



>This is the pertinent part of the "w" output:
>$w
>  5:25pm  up 5 days,  6:43,  9 users,  load average: 8.92, 8.06, 6.89

>someone  ttyp5    Thu 9am 2days                -

>I should add that "ps" shows no ttyp5 or someone processes.

>I tried "chown root /dev/ttyp5; chgrp root /dev/ttyp5" (they did the changes)
>But, the same "w" output still... What's going on here?

        I have seen this too. In one case I know of, it happens when a
login shell gets orphaned in a 'peculiar' way:

# the numbers indicate different shells. A (#) indicated login shell
$(1) screen  (screen is not suid so it doesn't make an /etc/utmp entry and
          therefore only the login shell that called screen is recorded)
$2 login  
...
$(3) logout
$2 exit (kill screen)
$(1) now back to original login shell and output of 'w' shows that '-'
     process which has no pid associated with it but it does have an
     assoicated terminal.

 The only way that I know of to kill this process is to reboot the machine.
 Normally, init would inherit such processes and their pid would be 1 but
 in this case I can't tell what is going on. Anyone else know exactly what
 is happening? I don't think the second login shell is ever recorded
 properly in /etc/utmp since you called login (which does write to utmp)
 from a shell that was not recorded. Obviously, what was known about it
 was written (like username, tty, etc) but no location. Why can't I
 reconnect to it though and why doesn't it show up on a ps?            

-tms
--
From the Lab of the MaD ScIenTiST:



 
 
 

strange /usr/ucb/w output

Post by Jamie Mas » Tue, 24 Mar 1992 20:18:31



>This is the pertinent part of the "w" output:

>$w
>  5:25pm  up 5 days,  6:43,  9 users,  load average: 8.92, 8.06, 6.89

>someone  ttyp5    Thu 9am 2days                -

    I've seen this a million times.  There is an entry for "someone"
on ttyp5 which did not get removed from utmp.  Remove it and the
strange line in w will go away.

    There are two ways you can do this.  If the tty has already been
chowned back to root, then as a normal user, you can rlogin to
the machine recursively until rlogind grabs the pty line for itself.

    Or, if you have privileges, you can edit utmp yourself, probably
with the help of a program that floated through here a few months
ago.

Quote:>I should add that "ps" shows no ttyp5 or someone processes.

>I tried "chown root /dev/ttyp5; chgrp root /dev/ttyp5" (they did the changes)
>But, the same "w" output still... What's going on here?

    Are you running X?  Xterms have a bad habit of dying without
cleaning up, in exactly the way you describe.

Jamie