Have you previously killed any sessions of user test
using kill -9
?
Depending on operating system and the way it handles updates to the utmp
/wtmp
files, killing a user session with kill -9
may cause its session record in the utmp
file to be left in a "session is active" state.
When a new session using the same (pseudo)TTY device is initialized, the code that writes the utmp
entry sees that the slot for that TTY device is already used by an active entry, and uses the next free slot.
Then, commands like w
, who
or finger
have a sensible expectation that only one user at a time can be using a TTY device, so once they find one entry for a particular TTY device, they won't look for any others... and so they display the wrong, stale entry instead of the one that is actually current.
The utmpdump
command can be used to dump the binary utmp
file into text format, for seeing if this kind of utmp corruption has happened. Then you can edit the text version to remove the stale entries, and use utmpdump -r
to reconstruct a new binary utmp
file with the corrupted entries removed.
Or, if you can have all the users log out for a moment, just have everyone else log out, truncate the utmp file to zero size, logout and log back in.
# echo "Everyone logout now, please" | wall
# > /var/run/utmp
# <logout>
And in the future, please use kill -HUP
to end shell sessions instead of kill -9
or kill -KILL
to avoid this problem in the first place.
alistair
), give itsudo
rights be editingsudoers
, and never login asroot
at all, unless in emergencies. (yes, you didn't ask this, but I've seen many people use root as their main account, which isn't a good idea).w
orwho
don't print any interesting or reliable info. Do not rely on them. Longer rant here