From owner-freebsd-questions@FreeBSD.ORG Wed Feb 18 09:16:15 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id F0C251065670 for ; Wed, 18 Feb 2009 09:16:15 +0000 (UTC) (envelope-from mexas@bristol.ac.uk) Received: from dirg.bris.ac.uk (dirg.bris.ac.uk [137.222.10.102]) by mx1.freebsd.org (Postfix) with ESMTP id ABCAB8FC1E for ; Wed, 18 Feb 2009 09:16:15 +0000 (UTC) (envelope-from mexas@bristol.ac.uk) Received: from isis.bris.ac.uk ([137.222.10.63]) by dirg.bris.ac.uk with esmtp (Exim 4.69) (envelope-from ) id 1LZiXM-0000cI-RL; Wed, 18 Feb 2009 09:16:14 +0000 Received: from mech-cluster238.men.bris.ac.uk ([137.222.187.238]) by isis.bris.ac.uk with esmtp (Exim 4.67) (envelope-from ) id 1LZiXJ-000238-Pw; Wed, 18 Feb 2009 09:16:10 +0000 Received: from mech-cluster238.men.bris.ac.uk (localhost.men.bris.ac.uk [127.0.0.1]) by mech-cluster238.men.bris.ac.uk (8.14.3/8.14.3) with ESMTP id n1I9G1C1074842; Wed, 18 Feb 2009 09:16:05 GMT (envelope-from mexas@bristol.ac.uk) Received: (from mexas@localhost) by mech-cluster238.men.bris.ac.uk (8.14.3/8.14.3/Submit) id n1I9FrDu074841; Wed, 18 Feb 2009 09:15:53 GMT (envelope-from mexas@bristol.ac.uk) X-Authentication-Warning: mech-cluster238.men.bris.ac.uk: mexas set sender to mexas@bristol.ac.uk using -f Date: Wed, 18 Feb 2009 09:15:53 +0000 From: Anton Shterenlikht To: Ian Smith Message-ID: <20090218091553.GA74769@mech-cluster238.men.bris.ac.uk> References: <20090218013633.3309810656EC@hub.freebsd.org> <20090218175824.X38905@sola.nimnet.asn.au> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20090218175824.X38905@sola.nimnet.asn.au> User-Agent: Mutt/1.5.19 (2009-01-05) X-Spam-Score: -1.4 X-Spam-Level: - Cc: Anton Shterenlikht , freebsd-questions@freebsd.org Subject: Re: w(5) shows non-existent or lost process? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Feb 2009 09:16:16 -0000 On Wed, Feb 18, 2009 at 07:08:41PM +1100, Ian Smith wrote: > On Tue, 17 Feb 2009 13:43:30 +0000 Anton Shterenlikht wrote: > > > The who (or w, or finger) command shows that I'm still logged into ttyp5, > > even though I have rebooted the box many times since. Does this mean > > the corresponding entry in /var/run/utmp is wrong and shouldn't be there, or is there > > still some process attached to ttyp5? > > Certainly the former, given you've rebooted. I've had occasions when > utmp gets silly, though not for ages. Abrupt shutdown / power loss? > > > ouput of w: > > > > USER TTY FROM LOGIN@ IDLE WHAT > > mexas p4 1:32pm - w > > mexas p5 :0. 26Jan09 21days - > > > > ps ax | grep ttyp5 > > shows no process > > ps would only list it as 'p5' anyway. > > 'w -d' may be a bit more informative: > > % w -d > 6:00PM up 68 days, 15:22, 1 user, load averages: 0.58, 0.23, 0.13 > USER TTY FROM LOGIN@ IDLE WHAT > 3733 login [pam] (login) > 3734 -csh (csh) > 7333 /bin/sh /usr/X11R6/bin/startx > 7351 /usr/X11R6/bin/xinit /home/smithi/.xinitrc -- -auth /home/smithi/.serverauth.7333 -nolisten tcp > 7352 X :0 -auth /home/smithi/.serverauth.7333 -nolisten tcp (Xorg) > 7356 /bin/sh /usr/local/bin/startkde > 7421 kwrapper ksmserver > smithi v7 - 12Dec08 68days /usr/X11R6/bin/xinit /home/smithi/.xinitrc -- -auth / > > > Looking at w(1) man page it seems that "-" in WHAT can be an indication > > that the process failed but not cleanly and that there could be some forked > > sub-process still alive. Does this make sense? Which other commands I can use > > to see what's going on? > > utmp(5) makes good bedtime reading :) > > /var/log/wtmp can get messed up sometimes too, especially if you're > logged in when periodic(8) monthly rotates it, but tools include: > > % last > smithi ttyp5 dolores Mon Feb 2 15:52 - 15:57 (00:05) > wtmp begins Mon Feb 2 15:52:27 EST 2009 > > !last -f /var/log/wtmp.0 > smithi ttyp5 rock.-----.org Mon Jan 26 19:37 - 23:17 (03:40) > smithi ttyp5 rock.-----.org Thu Jan 15 21:30 - 21:45 (00:14) > smithi ttyp5 rock.-----.org Thu Jan 15 18:04 - 18:05 (00:00) > smithi ttyp5 rock.-----.org Thu Jan 15 18:01 - 18:03 (00:01) > somebody ftp ww.xxx.yyy.zz Thu Jan 1 10:47 - 10:50 (00:03) > [..] > > % who > smithi ttyv7 Dec 12 02:39 > % who /var/log/wtmp.0 > [..] > somebody ftp61687 Jan 1 10:47 (ww.xxx.yyy.zz) > smithi ttyp5 Jan 15 18:01 (rock.-----.org) > smithi ttyp5 Jan 15 18:04 (rock.-----.org) > smithi ttyp5 Jan 15 21:30 (rock.-----.org) > smithi ttyp5 Jan 26 19:37 (rock.-----.org) > > % who am i > smithi ttyp4 Feb 18 18:16 > % tty > /dev/ttyp4 > > you could try opening enough xterms (ono) so your ttyp5 is used, then > exit them cleanly? Failing that, you can boot single user, mount /var, > rm /var/run/utmp, hit ^D (or reboot) .. IIRC I had to do that once; not > sure what happens if you rm /var/run/utmp while running multi-user! :) Ian, thank you. It's gone. Perhaps in the meantime I did log on to ttyp5 and exited cleanly. Thanks for the tips anyway. -- Anton Shterenlikht Room 2.6, Queen's Building Mech Eng Dept Bristol University University Walk, Bristol BS8 1TR, UK Tel: +44 (0)117 928 8233 Fax: +44 (0)117 929 4423