Search Text         
Search Tips?
Search By   And   Or   Boolean   Exact Match   TA #
Search In   Whole Doc   Keywords Sort By  
Product   Sub Product  

View Technical Articles (sorted by Product) New/Updated in the last:    7 days      14 days      30 days             
TA # Date Created Date Updated Resolved Issue?   Printer Friendly Version of This TA   Print Article
  E-mail This TA   E-mail Article
105610 06/16/1997 03:42 PM 03/10/2010 08:06 AM
Yes No
I want to clear my system of users who are not logged in.
Keywords
openserver enterprise host desktop faststart system release 5.0.0 5.0.2 5.0.4 5.0.5 5.0.6 502 504 505 506 osr5 v5 clearutmp internet ifs 1.1.0.0 tcp/ip client dos win who logged pseudo ttys users utmp wtmp auth tcb ale pttyupd cron clear phantom ghost whodo not cwtmp 507 5.0.7 600 6.0.0 openserver5 openserver6 osr5 osr6 uw uw7 uware uware7 unixware unixware7 7.0.0 700 7.0.1 701 7.1.0 710 7.1.1 711 7.1.2 712 ou ou8 openunix openunix8 8.0.0 800 7.1.3 713 7.1.4 714
Release
           
SCO OpenServer Enterprise System Release 5.0.0, 5.0.2, 5.0.4, 5.0.5, 5.0.6, 
5.0.7 
SCO OpenServer Host System Release 5.0.0, 5.0.2, 5.0.4, 5.0.5, 5.0.6, 5.0.7 
SCO OpenServer Desktop System Release 5.0.0, 5.0.2, 5.0.4, 5.0.5, 5.0.6, 5.0.7 
SCO Internet FastStart Release 1.0.0, 1.1.0 
SCO OpenServer Release 6.0.0 
SCO UnixWare Release 7.0.0, 7.0.1, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4 
SCO OpenUNIX Release 8.0.0 (7.1.2) 
Problem
          DOS or Windows TCP/IP clients that have logged into an
          SCO UNIX system through telnet turn off their DOS or WINDOWS
          system or enter <Ctrl><Alt><Del> after their DOS or 
Windows
          session has hung.  The UNIX "who" command on the SCO system
          reports them as still logged in.

          - or -

          DOS or Windows TCP/IP clients that have logged into an SCO UNIX
          system through telnet exit the SCO session normally, but the UNIX
          "who" command on the SCO system reports them as still logged in.

          - or -

          A system that is licensed for a certain number of users is unable
          to allow the number of licensed users to log in.

          - or -

          The "who" command shows users who are not logged in.

          - or -

          The system is no longer usable as the number of configured pseudo
          ttys are consumed by users who are no longer logged in.

          Rebooting the system does not seem to clear any of the above
          problems.

CAUSE:
          The /etc/utmp, /etc/wtmp, /etc/utmpx or /etc/wtmpx may be corrupt.

          The utmp file and related files record user and accounting
          information for commands such as "who", "finger" and "login".

          The utmp file contains information about the current state of the
          system, including one record for each logged-in user.  The login
          command writes or removes a record to the utmp file each time a user
          logs in or out.

          The wtmp file contains historical data; each time a user logs in or
          out, a record is written to wtmp.

          The utmpx and wtmpx files contain additional information such
          as the name of the remote host for users who log in via the
          network. This information is not transferred to utmp or wtmp.

          The utmp and its related files are open to login and other commands
          to write information about users' activities and expect that the
          commands that wrote to those files will clear a user properly
          after exiting a login session.  In some instances this may not
          occur, especially if the user is using a DOS or Windows TCP/IP
          stack.

          - and/or -

          The /etc/auth/system/ttys file may be corrupt.

          The ttys file (/etc/auth/system/ttys) contains entries for each
          terminal that can be used to log in to the system. Authentication
          programs use this database to determine if logging in is permitted
          on a particular terminal.

          Users and processes related to a user's session may still be
          consuming ttys even after the user has exited an SCO telnet
          session.  At some point the policy manager may not be able to
          function.


Solution
          /utmp, wtmp, utmpx and wtmpx may have become corrupt.

          As the user root, create the following script to clear utmp,
          wtmp, utmpx and wtmpx prior to shutdown:

   ----------------------cut here---------------------------------
   #!/bin/sh
   # /bin/clearutmp
   #
   # clear utmp, wtmp, utmpx and wtmpx on shutdown or bootup
   #
   > /etc/utmp
   > /etc/wtmp
   > /etc/utmpx
   > /etc/wtmpx
   ----------------------cut here---------------------------------

          Save the clearutmp script to /bin and run:

               # chmod 700 /bin/clearutmp

          The above script can be run manually prior to shutting the system
          down, or you can add the following lines at the end of
          /etc/bcheckrc to clear /etc/utmp, wtmp, utmpx and wtmpx during
          system start-up.

          As an example, add the following to the end of /etc/bcheckrc:

              #
              # Added to clear /etc/utmp, wtmp, utmpx and wtmpx on boot
              #
              > /etc/utmp
              > /etc/wtmp
              > /etc/utmpx
              > /etc/wtmpx

          Note: It is not recommended that /bin/clearutmp be run unless the
          system is about to be brought down.  The utmp and related files
          contain valuable information about system state and start-up times;
          clearing those files during run-time can cause unpredictable results.

          The following relates to OpenServer only:

          The /etc/auth/system/ttys file may be corrupt.

          As the user root, create the following shell script to clear the
          /etc/auth/system/ttys file:

------------------------------------cut here------------------------------------
#!/bin/sh
# /bin/clearttys
RC=0

mv /etc/auth/system/ttys /tmp/ttys.$$
touch /etc/auth/system/ttys
chown auth:auth /etc/auth/system/ttys

cd /tcb/bin
./ttyupd </dev/null >/dev/null 2>&1
RC=$?

if [ "$RC" -ne 0 ]; then
  echo "*ERROR* Running ./ttyupd (RC=$RC)" > /tmp/clearttys.log
else
  /tcb/bin/ale /etc/auth/system/ttys pttyupd </dev/null >/dev/null 2>&1
  RC=$?

  # Both 0 and 2 exit codes are success... exit 2 is used when there
  # are no ttys to update

  if [ "$RC" -ne 0 ] && [ "$RC" -ne 2 ]; then
    echo "*ERROR* Running ./pttyupd (RC=$RC)" >> /tmp/clearttys.log
  fi
fi

exit "$RC"
------------------------------------cut here------------------------------------

          Save the clearttys script to /bin and run:

               # chmod 700 /bin/clearttys

          The script, clearttys, can be run while the system is in multiuser
          mode when the "who" command displays users who are not logged in
          or use crontab to set up cron to run clearttys at regular intervals.

NOTE:
          To see where the user's have logged in from, ie. their IP address,
          use the "finger" command.  

          The same command is also applicable to UnixWare7/Open UNIX 8 and 
          OpenLinux as the "who -xm" command is only applicable to OpenServer.

NOTE:
          TROUBLESHOOTING:
          
          - Seeing "Can't find utmp entry for ptty" errors and unable to log in.
          The /etc/issue information is displayed on the screen but the login
          prompt doesn't appear.

          Clear down the /etc/utmp, utmpx, wtmp and wtmpx files in the same as
          described above then reboot your server.

          In addition, check that there are no additional network services that
          might be conflicting, such as "bootp" or a service also using port 23.


SEE ALSO:
          For information on the ttyupd command, which achieves the same
          result as the script above, see: 

          Technical Article 100737 - "I want to know what the /etc/utmp and /etc/wtmp files 
          contain."

          Technical Article 104588, "Rebuild ttys file from inittab including pseudo ttys 
          after crash."

          Technical Article 105755, "How to use the cwtmp utility to clear stale entries
          from utmp and related files."

          cron(C), crontab(C), ttys(F), rc(ADM), bcheckrc(ADM), who(C), w(C),
          last(C)
Back to Search ResultsBack to Search Results