Who is *really* logged in?

[Ben Duncan]

Ok ... here goes some EXPLANATION ....

Brad De Vries wrote:
> Hey all, I'm curious if someone can answer this question.  I ran a few
> commands and it's not entirely clear to me.
> 
> $ who /var/log/wtmp | wc -l

the who done in this matter will parse the FILE. IT shows all the
history of logins. I could have an empty file, login and log out
and then log in again and would now have 2 entries in the system.
It is true historical in nature.

> 23291
> $ who | wc -l
> 579

who a w both use the /var/run/utmp file for gathering active users,
as does uptime.


> $ who /var/run/utmp | wc -l
> 579
> $ uptime
>  11:39:04 up 97 days, 20:35, 579 users,  load average: 1.62, 1.05, 1.01
> $ w | wc -l
> 51
> 

'w' is going to ALSO  put some headers in the output ..
TRY doing a
'who'
and then a
'w'

and see if they match. More than likely they will.

> $ cat /etc/redhat-release
> Red Hat Enterprise Linux AS release 4 (Nahant Update 5)
> 
> I've gathered that wtmp is historical whereas utmp is current, so I
> can accept the first two answers.  What I can't understand is why
> "who" and "uptime" show 579 users and "w" only shows 51.
> 
> The reason I started investigating this is because I see some users
> logged in under "who" but when I try to "ps -ft pts/###" it responds
> with "ERROR: TTY could not be found."
> 
> Any thoughts?
> 
> TIA,
> Brad.

Another thing to make sure of, is that you do not have any STALE wtmp / utmp
files. Mine get rotated once a day by a cron job.

-- 
Ben Duncan - Business Network Solutions, Inc. 336 Elton Road  Jackson MS, 39212
"Never attribute to malice, that which can be adequately explained by stupidity"
        - Hanlon's Razor