HP-UX B.11.23 U ia64
I've got two users that show in "w" with long idle times but if I search for their processes I find nothing (ps -ef | grep username )
I'm not sure why "w" still sees them and if there is anything (short of a reboot) that I can do to clean them out.
Ideas?
Please cut and paste the output of your w and ps -ef | grep ... commands.
Thanks.
I didn't want some of those specifics out on the 'net but I'll see what I can do with some cut and paste I guess.
Here is more or less what I get with "w" - usernames are changed. It is name8 and name9 that I want to clear up.
12:07pm up 337 days, 1:49, 10 users, load average: 0.03, 0.02, 0.02
User tty login@ idle JCPU PCPU what
name1 console 10:19am8088:23 -sh
name2 pts/ta 9:49am 21 natural parm=readonly rdnode=
10.32.13.188
name2 pts/tb 10:22am 1:44 -sh
name3 pts/tc 12:04pm 2 natural parm=idsparm
name4 pts/te 9:30am 2:37 natural parm=idsparm
me pts/tf 8:53am -sh
name6 pts/th 11:50am 14 natural parm=idsparm
name7 pts/tg 11:45am 5 natural parm=idsparm
name8 pts/t2d 9:54am3339:03 -
name9 pts/t0h 9:49am7825:17
and here is the output of ps -ef | grep name8
me@myserver:/users/sag/prod/reports> ps -ef | grep name8
me 7845 28284 0 12:09:55 pts/tf 0:00 grep name8
only my grep command comes back. Same result if I search for name9
w reads a file - usually wtmpx. Those are not real processes, ie., if ps does not see them they became defunct and removed. Clearly, they were removed from the process table, but not cleaned up in the utmpx/wtmpx file.
A reboot will remove them, but I don't see what that gains on a production box, other than user complaints. 
Sorry about the lack of tags. I haven't posted in a long time and didn't catch the hint.
We're in the process of closing out the applications on this server and when I'm capturing the user stats every 15 minutes I was just getting annoyed at being over by two no matter the time of day so I thought I'd clean them if it was easy to do. Not worth a reboot though. I can just keep explaining that the 2 users on at 2AM every day are not really there.
Maybe they are just trying to get in some virtual overtime 
Sitting idle for >100 days isn't going to cut it I don't think
On HP-UX the commands "w" , "uptime" and "who" all read the file /etc/utmp .
If you want to see what is in that file in human-readable format:
cat /etc/utmp | /usr/sbin/acct/fwtmp
As others state, it takes a reboot to bring the file back in sync with reality. Inconsistencies can result from use of "kill -9" or program crashes.
As it happens, another group has some maintenance scheduled for Sunday and I'll be shutting down the server for the duration so it will probably all be cleared up after the reboot. Thanks for all the information though.