User in who but no processes

UNIX for Advanced & Expert Users
1

Hi all!
After killing some processes, I encounter the following problem:

1) some delay in the login process
2) question marks (?) in who output
3) when doing ps -fu for users with question mark in who, no process is runing.

To solve this problem I shutdown the system. Does anyone know the reason and any better way to slolve?

Thank you in advance.

2

Did you search specific for your OS? What kind of Unix or Linux is it? Are you up-to-date with patches etc?
Had something like this on 2 old AIX 5.1 boxes. They were already on the latest level and since they were running ok I did not dig any further since AIX 5.1 is somewhat old.
Just for curiousity you could check your wtmp with last or something like that.

3

Thank you zaxxon!
We're using RedHat.
Output of uname -a is:
Linux cht0011 2.6.9-5.ELsmp ...
We've not installed any patches since the systme creation (about 3 years).

2) Can I remove /var/log/wtmp when the system is runing in multi user mode (state 5)?
Is there any danger to remove the file and then recreate it using touch? Even easier to
something like:

>/var/log/wtmp
4

its due to a utmp / wtmp file mismatch...and so your accounting information is out of sync
This is what I do on HP-UX:
there is a wtmpfix utility:

wtmpfix /var/~/stmp >temp
fwtmp -x < temp > /var/~/wtmp

And in last resort, create a null file...

---------- Post updated at 16:59 ---------- Previous update was at 16:49 ----------

You could try to compile (need modifications to suit your OS, it was for HPUX...) and use this program given to me by my friend Andreas long ago:

/*
 * fix utmp file for 'zombie' logins
 * Looks if the pid of user processes are realy running
 *
 * Usage: utmpfix [utmp_file]
 *
 * hpux@voss2000.de 2000-09-28
 *
 */

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <utmp.h>


main(argc, argv)
int    argc;
char **argv;
{
  char        *file ;
  struct utmp *entry;

  if(argc > 1)
    file=argv[1];
  else
    file=UTMP_FILE;

  utmpname(file);

  while((entry = getutent()) != (struct utmp *)NULL)
  {
    entry->ut_user[8] = 0;
    if(entry->ut_type == USER_PROCESS)
    {
      if(kill(entry->ut_pid, 0) != 0) /* check for pid exsistens */
      {
        entry->ut_type = DEAD_PROCESS; /* no pid -> change to dead proc */
        if(_pututline(entry) == NULL)
        {
          (void) fprintf(stderr, "utmpfix: cannot write to %s!\n", file);
          exit(1);
        }
      }
    }
  }
  endutent();
  return(0);
}
5

Also check whether wtmp is 2 Gb in size and whether the /var partition is full.