Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 10 Jan 1995 01:40:13 -0800 (PST)
From:      bmk@dtr.com
To:        questions@FreeBSD.org, bugs@FreeBSD.org
Subject:   phantom users
Message-ID:  <199501100940.BAA10962@dtr.com>

next in thread | raw e-mail | index | archive | help

A few months ago, I had a problem under 1.1 and 1.1.5.1 with users
showing as logged in on sio ports long after they'd logged out.  I
observed this under 2.0 shortly after I upgraded.  The problem seemed to
cure itself, so I forgot about it.

Today I noticed it again.

I did a 'who':

bmk      tty00   Jan 10 00:01
uuramjet tty01   Jan  9 22:55

The bmk entry is valid... I am indeed logged in on tty00.  uuramjet is a
phantom entry.  uuramjet is a uucp login, and it's been logged out for
almost three hours, as is proved by my uucp log:

uucico - - (1995-01-09 22:55:12.92 6054) Incoming call (login uuramjet port tty01)
uucico ramjet - (1995-01-09 22:55:13.50 6054) Handshake successful (protocol 'i' sending packet/window 1024/16 receiving 1024/16)
uucico ramjet root (1995-01-09 22:55:14.75 6054) Receiving rmail ramjet.dtr.com!roger (1763 bytes)
uucico ramjet root (1995-01-09 22:55:15.62 6054) Receiving rmail ramjet.dtr.com!rjc (1318 bytes)
uucico ramjet root (1995-01-09 22:55:16.34 6054) Receiving rmail ramjet.dtr.com!roger (1696 bytes)
uucico ramjet - (1995-01-09 22:55:17.04 6054) Protocol 'i' packets: sent 8, resent 0, received 14
uucico ramjet - (1995-01-09 22:55:17.24 6054) Call complete (5 seconds 4777 bytes 955 bps)
uuxqt ramjet root (1995-01-09 22:55:19.85 9679) Executing X.ramjetC0044 (rmail ramjet.dtr.com!roger)
uuxqt ramjet root (1995-01-09 22:55:20.92 9679) Executing X.ramjetC0047 (rmail ramjet.dtr.com!rjc)
uuxqt ramjet root (1995-01-09 22:55:21.84 9679) Executing X.ramjetC004a (rmail ramjet.dtr.com!roger)
uux ramjet daemon (1995-01-09 23:00:17.76 9703) Queuing rmail rjc@ramjet.dtr.com (D.001N)
uux ramjet daemon (1995-01-09 23:00:18.78 9704) Queuing rmail roger@ramjet.dtr.com (D.001Q)
uux ramjet daemon (1995-01-09 23:00:19.83 9705) Queuing rmail roger@ramjet.dtr.com (D.001T)

Just for kicks, here's the output of last | head -20 (with some notes):

bmk       tty00                     Tue Jan 10 00:01   still logged in
# Here's the entry I'm talking about.
uuramjet  tty01                     Mon Jan  9 22:55   still logged in
# Here it is again.  I was only on for about an hour.
bmk       tty00                     Mon Jan  9 21:10 - 00:01  (02:51)
root      ttyv1                     Mon Jan  9 18:56 - 19:27  (00:30)
bmk       ttyv1                     Mon Jan  9 18:15 - 18:56  (00:40)
bmk       ttyv0                     Mon Jan  9 18:10 - 19:35  (01:24)
reboot    ~                         Mon Jan  9 18:10 
# it happened here.  It's a long story, but I had to reset the
# machine at 18:10.  uuramjet had been logged out for a long time.  Each
of the following five connections were very short ones.
uuramjet  tty01                     Mon Jan  9 14:16 - crash  (03:53)
uuramjet  tty01                     Mon Jan  9 13:50 - 14:16  (00:26)
uuramjet  tty01                     Mon Jan  9 13:27 - 13:50  (00:22)
uuramjet  tty01                     Mon Jan  9 12:35 - 13:27  (00:52)
uuramjet  tty01                     Mon Jan  9 12:29 - 12:35  (00:05)
reboot    ~                         Mon Jan  9 12:26 
shutdown  ~                         Mon Jan  9 12:07 
bmk       ttyp1    k2               Mon Jan  9 11:42 - shutdown  (00:24)
reboot    ~                         Mon Jan  9 11:41 
shutdown  ~                         Mon Jan  9 06:20 
root      ttyv1                     Mon Jan  9 05:46 - shutdown  (00:33)
bmk       ttyv1                     Mon Jan  9 05:33 - 05:46  (00:12)
root      ttyv0                     Mon Jan  9 05:09 - shutdown  (01:11)

And for your viewing pleasure, here's the stty settings on the port;
although I doubt it's relavent.

speed 115200 baud; 0 rows; 0 columns;
lflags: -icanon -isig -iexten -echo -echoe -echok -echoke -echonl
	-echoctl -echoprt -altwerase -noflsh -tostop -flusho -pendin
	-nokerninfo -extproc
iflags: -istrip -icrnl -inlcr -igncr -ixon -ixoff -ixany -imaxbel -ignbrk
	-brkint -inpck -ignpar -parmrk
oflags: -opost -onlcr -oxtabs
cflags: cread cs8 -parenb -parodd hupcl -clocal -cstopb crtscts -mdmbuf
cchars: discard = ^O; dsusp = ^Y; eof = ^D; eol = <undef>;
	eol2 = <undef>; erase = ^?; intr = ^C; kill = ^U; lnext = ^V;
	min = 1; quit = ^\; reprint = ^R; start = ^Q; status = <undef>;
	stop = ^S; susp = ^Z; time = 0; werase = ^W;

I can find no rhyme or reason to this.  If this was just my personal
system, I wouldn't care.  The problem is that I need to account for
every minute of login time, ESPECIALLY that done on sio ports.

I'd be happy to try and hunt this bug down, even though I'm not a C
wizard, but I'm very desparate to get a fix for this.  Has anyone else
seen this, and is there some kind of fix or workaround?  Where should I
start looking for this possible bug?  It looks to me that wtmp is not
always getting updated when the user logs out, but it never seems to
happen on ptys.

HELP!  Free pizza and beer to the person who can help me fix this...
but you'll have to visit Portland to collect!




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199501100940.BAA10962>