3

For me, uptime yields 9 users, but

ps -Af | cut -f1 -d' ' | sort | uniq | wc -l yields 14.

I'm not exactly sure where the 9 is coming from.

Before I jump to conclusions though, please let me know if you guys do not have such a discrepancy.

  • You can use w to see more information about those 9 users. Your ps -Af pipeline does not work at all on any of my systems, but have you looked at what it's reporting without using wc -l? It is probably showing some UIDs that don't show up in uptime/w like noaccess, nobody, etc – Jesse_b Aug 3 '18 at 20:48
  • @Jesse_b I had no idea about w. Thank you. Yes, that is indeed what was happening. (On a side note, the -A means 'all', and -f means 'full'. Maybe try -e instead of -A? Idk what version of ps you are using, but mine is procps-ng ps(1)). A follow up: what is the difference between users that show up in w, and users like nobody, etc.? – extremeaxe5 Aug 3 '18 at 20:57
3

You're comparing apples and oranges.

ps will list the processes running. You're then getting the count of unique process-owning user ids.

uptime will report the users logged on. By using utmp. More details at https://github.com/coreutils/coreutils/blob/master/src/uptime.c#L177

So, comparison of output, highlighting this, below.

# uptime
 16:52:37 up 30 days, 23:32,  1 user,  load average: 0.04, 0.04, 0.05
# w
 16:57:33 up 30 days, 23:37,  1 user,  load average: 0.00, 0.01, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
steve    pts/0    cpc79909-stkp12- 16:50    5.00s  0.07s  0.28s sshd: steve [priv]
#


# ps -Af | cut -f1 -d' ' | sort | uniq | wc -l
7
# ps -Af | cut -f1 -d' ' | sort | uniq
chrony
dbus
polkitd
postfix
root
steve
UID
#
  • 1
    What is the difference between a "user logged on" and a "process-owning user id?" Is there a distinction between a "logged on user" and a special one, like the superuser? I thought that all users essentially were on equal footing. – extremeaxe5 Aug 3 '18 at 21:00
  • So in the example, we've got a process running as username 'postfix'. That's some process relating to email. 'postfix' is a username. But it's not a user. Hope this helps. – steve Aug 3 '18 at 21:12
  • it’s not? It is listed in /etc/passwd – extremeaxe5 Aug 3 '18 at 21:13
  • 1
    It's a username. But it's not someone who has logged onto the device. Folk logging onto the device is what 'uptime' reports. It doesn't report active processes by username. – steve Aug 3 '18 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.