NetNews Usenet Archive 1993 #3/NN_1993_3.iso/spool/comp/sys/hp/15358

Internet Message Format | 1993-01-28 | 8.3 KB

From: [e-mail] (Frank Slootweg CRC)
Date: Tue, 26 Jan 1993 09:57:11 GMT
Subject: Re: Problem with utmp entries
Message-ID: <[e-mail]>
Organization: Hewlett-Packard, The Netherlands
Path: sparky!uunet!mcsun!Germany.EU.net!gmd.de!newsserver.jvnc.net!darwin.sura.net!gatech!swrinde!sdd.hp.com!hpscit.sc.hp.com!hplextra!hpcc05!hpbbn!hpuamsa!franks
Newsgroups: comp.sys.hp
References: <[e-mail]>
Lines: 196

[e-mail] (D.L.Lindsey) writes:

> I have a cluster of HP9000 workstations, running HP8.00.  The utmp file is
> not being cleared properly when people log out.     When I do a finger it
> looks like there are still people logged in although they have no processes
> running.  Entries for these people still exist in the utmp file.
>
> Does anyone know what might be causing this and how I might go about
> solving it?

  The problem is probably not that utmp is not being cleared properly,
but that is is corrupt due to a previous event. Below I have attached a
recent string about this subject.

  Hope this helps.

Frank Slootweg, HP, Dutch Customer Response Center

From [e-mail] Tue Nov  3 02:37:18 1992
From: [e-mail] (Phil Scarr)
Date: Tue, 3 Nov 1992 01:37:18 GMT
Date-Received: Wed, 4 Nov 1992 03:10:55 GMT
Subject: Resetting the /etc/utmp, wtmp files after crashed logins
Message-ID: <[e-mail]>
Organization: Neuroclinical Trials Center, University of Virginia
Path: hpuamsa!hpbbn!hpcc05!hplextra!scd.hp.com!hpscdm!sdd.hp.com!caen!uvaarpa!murdoch!brain.med.virginia.edu!prs9k
Newsgroups: comp.sys.hp,comp.unix.questions
Sender: [e-mail]
Lines: 15
Xref: hplextra comp.sys.hp:8565 comp.unix.questions:8043

After a recent power failure, several PCs which were logged into our
HP9000 system crashed but their logins still show up with the w command.
There are no associated processes for these logins, they are just
phantoms.  Is there any way to reset these ptys?  I would assume you
could reset the /etc/utmp and wtmp files to do this, but I don't know
how.  Help!

    -Phil
--
PHIL SCARR        \      We are Microsoft...     /          (o) 804.243.0229
  University of   /     OS/2 is irrelevant.      \          (f) 804.243.0290
   Virginia,      \     UNIX is irrelevant.      /        [e-mail]
     Neurosurgery /     Openness is futile.      \     [e-mail]
       NTC        \ Prepare to be assimilated... /   ...uunet!virginia!prs9k


From franks Wed Nov  4 13:41:55 1992
From: [e-mail] (Frank Slootweg CRC)
Date: Wed, 4 Nov 1992 12:41:55 GMT
Date-Received: Wed, 4 Nov 1992 12:41:55 GMT
Subject: Re: Resetting the /etc/utmp, wtmp files after crashed logins
Message-ID: <[e-mail]>
Organization: Hewlett-Packard, The Netherlands
Path: hpuamsa!franks
Newsgroups: comp.sys.hp
References: <[e-mail]>

[e-mail] (Phil Scarr) writes:

> After a recent power failure, several PCs which were logged into our
> HP9000 system crashed but their logins still show up with the w command.
> There are no associated processes for these logins, they are just
> phantoms.  Is there any way to reset these ptys?  I would assume you
> could reset the /etc/utmp and wtmp files to do this, but I don't know
> how.  Help!

  Unless you are using accounting (or otherewise using the information
from /etc/wtmp), you only have to fix the /etc/utmp file. If you want to
do this neatly then use fwtmp (see fwtmp(1m)) on the /etc/utmp file. Look
at the format in utmp(4). I *think* you should change the ut_type field
of the unwanted entries to 8 (DEAD_PROCESS). Alternatively you can use
the quick and dirty method:

# shutdown 0
# >/etc/utmp
# reboot

Disclaimer: No guarantee, but this should work.

Frank Slootweg, HP, Dutch Customer Response Center

From [e-mail] Thu Nov  5 15:34:13 1992
From: [e-mail] (Christian Finger)
Date: Thu, 5 Nov 1992 14:34:13 GMT
Date-Received: Fri, 6 Nov 1992 02:54:29 GMT
Subject: Re: Resetting the /etc/utmp, wtmp files after crashed logins
Message-ID: <[e-mail]>
Organization: Computer Center, University of Karlsruhe, Germany
Path: hpuamsa!hpbbn!hpcc05!hplextra!scd.hp.com!hpscdm!sdd.hp.com!caen!sol.ctr.columbia.edu!ira.uka.de!rz.uni-karlsruhe.de!rz.uni-karlsruhe.de!chris
Newsgroups: comp.sys.hp,comp.unix.questions
References: <[e-mail]>
Sender: [e-mail] (USENET 'No news is bad news' News System)
Reply-To: [e-mail]
Lines: 48
Xref: hplextra comp.sys.hp:8678 comp.unix.questions:8211

In article <[e-mail]>, [e-mail] (Phil Scarr) writes:
| After a recent power failure, several PCs which were logged into our
| HP9000 system crashed but their logins still show up with the w command.
| There are no associated processes for these logins, they are just
| phantoms.  Is there any way to reset these ptys?  I would assume you
| could reset the /etc/utmp and wtmp files to do this, but I don't know
| how.  Help!
|
|     -Phil

The following program will do the job for you:

/*
 * this code is in the public domain.  do with it as you
 * please.  - jfh. 12/19/90
 */

#include <sys/types.h>
#include <utmp.h>
#include <fcntl.h>

main ()
{
    int    fd;
    struct    utmp    utmp;

    if ((fd = open ("/etc/utmp", O_RDWR)) < 0)
        exit (1);

    while (read (fd, &utmp, sizeof utmp) == sizeof utmp) {
        if (utmp.ut_type != DEAD_PROCESS &&
                kill (utmp.ut_pid, 0) != 0) {
            lseek (fd, - (long) sizeof utmp, 1);
            utmp.ut_type = DEAD_PROCESS;
            write (fd, &utmp, sizeof utmp);
        }
    }
    close (fd);
}

Hope that helps,
    -Christian
--
  .     Christian Finger         |  Tel   : [phone]
 |||    Computer Center          |  Fax   : [phone]
\|||    University of Karlsruhe  |  EMail : [e-mail]
    /   Postfach 6980            |  X.400 : S = finger; OU = rz
        D-7500 Karlsruhe 1       |          P = uni-karlsruhe; A = dpb; C = de

From [e-mail] Fri Nov  6 18:35:04 1992
From: [e-mail] (Dave Serisky)
Date: Fri, 6 Nov 1992 17:35:04 GMT
Date-Received: Sun, 8 Nov 1992 02:51:23 GMT
Subject: Re: Resetting the /etc/utmp, wtmp files after crashed logins
Message-ID: <[e-mail]>
Organization: Hewlett-Packard Co., Corvallis, OR, USA
Path: hpuamsa!hpbbn!hpcc05!hplextra!scd.hp.com!hpscdm!cupnews0.cup.hp.com!news1.boi.hp.com!hp-pcd!hpcvusn!hpcvusd.cv.hp.com!daves
Newsgroups: comp.sys.hp,comp.unix.questions
References: <[e-mail]> <[e-mail]>
Sender: [e-mail] (Nobody - UID must be 99999)
Lines: 35
Xref: hplextra comp.sys.hp:8741 comp.unix.questions:8314
Nntp-Posting-Host: hpcvusd.cv.hp.com

In article <[e-mail]>, [e-mail] (Christian Finger) writes:
|> In article <[e-mail]>, [e-mail] (Phil Scarr) writes:
|> | After a recent power failure, several PCs which were logged into our
|> | HP9000 system crashed but their logins still show up with the w command.
|> | There are no associated processes for these logins, they are just
|> | phantoms.  Is there any way to reset these ptys?  I would assume you
|> | could reset the /etc/utmp and wtmp files to do this, but I don't know
|> | how.  Help!
|> |
|> |     -Phil
|>
|> The following program will do the job for you:
|>
|> /*
|>  * this code is in the public domain.  do with it as you
|>  * please.  - jfh. 12/19/90
|>  */
|> ...

There are a few potential problems with the posted program.  The
/etc/utmp file contains entries of types other then USER_PROCESS or
DEAD_PROCESS.  The program will probably mess up the utmp entries for
the various system entries.  Also, I think there are a few other fields
that need to be set or cleared in order to make a "legal" DEAD_PROCESS.

Casual mucking with the /etc/utmp file can cause problems with your
system.  Problems can range from growing /etc/utmp files to duplicate
/etc/utmp entries for a single tty/pty (which can confuse applications)
to corruption that can prevent you from logging into your system and
will require a reboot to fix.

[BTW, take a look at the getutent(3C) man page for some convenient
functions for working with the /etc/utmp file.]

-- Dave Serisky