Bug #2783
open
/usr/bin/users, /usr/bin/who and /usr/bin/w don't seem to find all users correctly
0%
Description
~$ cat /etc/release
OpenIndiana Development oi_151.1.4 X86 (powered by illumos)
Copyright 2011 Oracle and/or its affiliates. All rights reserved.
Use is subject to license terms.
Assembled 22 April 2012
scratching my head again, seems something is wrong here.
Normally /usr/bin/users or /usr/bin/who should return all active users.
This morning I expected to see myself logged in via ssh, and two VNC users (christine and sonia).
~$ users christine richard ~$ who richard pts/1 mai 25 08:50 (xx.xxx.xxx.xx) christine dtremote mai 25 08:46 (::1::1:2) ~$ w 10:52am up 9 day(s), 18 hr(s), 2 users, load average: 0,47, 0,51, 0,44 User tty login@ idle JCPU PCPU what richard pts/1 8:50am 1 w christin dtremote 8:46am 2:07 7:37 1:01 /usr/bin/xscreensaver -nosplash
? check with ps aux and confirmed that sonia was indeed logged in.
tried the following:
~$ who -a
. system boot mai 15 16:52
. run-level 3 mai 15 16:52 3 0 S
zsmon . mai 15 16:52 2095
LOGIN console mai 15 16:53 3062
richard + pts/1 mai 25 08:50 . 17317 (xx.xxx.xxx.xx)
sonia dtremote mai 24 17:14 4554 id=::ff term=0 exit=0 (::ffff:127.0.0.1::ffff:127.0.0.1:0)
richard pts/2 mai 24 14:07 0 id= /2 term=0 exit=0
richard pts/3 mai 15 17:17 0 id= /3 term=0 exit=0
richard pts/2 mai 24 19:02 9503 id=ts/2 term=0 exit=0
christine + dtremote mai 25 08:46 0:08 17048 (::1::1:2)
vboxuser pts/1 mai 24 09:29 0 id= /1 term=0 exit=0
~$ ck-list-sessions
Session87:
unix-user = '202'
realname = 'Sonia xxx'
seat = 'XDMCP__1_1'
session-type = ''
display-type = ''
open = 'TRUE'
active = 'TRUE'
x11-display = '::1:1'
x11-display-device = '/dev/dtremote'
display-device = ' ? '
remote-host-name = '::1'
is-local = 'FALSE'
on-since = '2012-05-25T06:16:08.090248Z'
login-session-id = ''
idle-since-hint = ''
SessionHeadlessSeatHeadless:
unix-user = '50'
realname = 'GDM Reserved UID'
seat = 'HeadlessSeat'
session-type = 'LoginWindow'
display-type = 'Headless'
open = 'TRUE'
active = 'TRUE'
x11-display = ':32'
x11-display-device = '/dev/dtlocal'
display-device = ' ? '
remote-host-name = ''
is-local = 'TRUE'
on-since = '2012-05-15T14:52:56.735290Z'
login-session-id = ''
idle-since-hint = '2012-05-15T14:58:10.858598Z'
Session89:
unix-user = '201'
realname = 'Christine xxxx'
seat = 'XDMCP__1_2'
session-type = ''
display-type = ''
open = 'TRUE'
active = 'TRUE'
x11-display = '::1:2'
x11-display-device = '/dev/dtremote'
display-device = ' ? '
remote-host-name = '::1'
is-local = 'FALSE'
on-since = '2012-05-25T06:46:04.412076Z'
login-session-id = ''
idle-since-hint = ''
Session85:
unix-user = '50'
realname = 'GDM Reserved UID'
seat = 'XDMCP__ffff_127_0_0_1_0'
session-type = 'LoginWindow'
display-type = ''
open = 'TRUE'
active = 'TRUE'
x11-display = '::ffff:127.0.0.1:0'
x11-display-device = '/dev/dtremote'
display-device = ' ? '
remote-host-name = '::ffff:127.0.0.1'
is-local = 'FALSE'
on-since = '2012-05-24T16:56:31.707371Z'
login-session-id = ''
idle-since-hint = '2012-05-24T17:01:29.302034Z'
Files
Updated by Richard PALO over 11 years ago
what even more strange:
~$ who /var/adm/wtmpx ... richard sshd mai 25 05:28 (xx.xxx.xxx.xx) richard pts/1 mai 25 05:28 (xx.xxx.xxx.xx) richard sshd mai 25 08:00 (xx.xxx.xxx.xx) richard pts/1 mai 25 08:00 (xx.xxx.xxx.xx) sonia dtremote mai 25 08:16 (::1::1:1) christine dtremote mai 25 08:46 (::1::1:2) richard sshd mai 25 08:50 (xx.xxx.xxx.xx) richard pts/1 mai 25 08:50 (xx.xxx.xxx.xx)
this wouldn't have anything to do with 'christine' being 9 characters, would it?
I seem to remember Garrett mentioning something about potential utmpx problems
which I believe Oracle has since remedied (but after the Fork!Yeah date)...
Updated by Gary Mills about 11 years ago
- File dumputmp.c dumputmp.c added
There are two different issues covered here. The first is that the vnc session owned by sonia seems to have disappeared. My reading of your `who -a' output is that all of the lines that contain `id=' are DEAD_PROCESS type. If you can reproduce this problem, please compile and run the dumputmp.c file that I've attached to confirm my guess. This interpretation suggests that something has performed its logout procedure on this session. I'm guessing it was done by the next vnc login, making it a vnc bug rather than an illumos bug.
The other issue seems to be a difference in the way sessions are recorded for ssh logins. Using `last' and `dumputmp /var/adm/wtmpx', I notice that each ssh login on illumos writes two sets of session records. The first has a null ID with `sshd' as the line name. The second has `ts/N' as the ID and `pts/N' as the line name, where N is the pty number. With the same tools on a Solaris 11 system, I notice only one set of session records. They have a null ID but the line name is `sshd-PID' where PID is the process number. This is a different way to ensure that the line name is unique. I assume that their `last' and `who' strip the dash and the PID when they display sessions.
This whole wtmp/utmp/lastlog system of recording session information was designed for command-line logins where a tty was always present. It's had many tweaks over the years to accomodate GUI sessions that don't use a tty. Maybe it needs a few more tweaks or a redesign now.