we have another server running the same OS which do not have this problem.

Below is the scenerio,

root # who |grep bwopn1
bwopn1 pts/27 Feb 16 08:18 (10.3.1.251)
bwopn1 pts/153 Feb 16 09:03 (10.3.1.251)
bwopn1 pts/163 Feb 16 09:07 (10.3.1.251)

root # ps -ef |grep db |grep bwopn1
bwopn1 3818 3811 2 08:18:11 pts/27 6:35 /u/recital/db.exe -x tntbw
bwopn1 6691 6652 0 09:07:08 pts/163 0:01 /u/recital/db.exe -x tntbw
bwopn1 6321 6304 0 09:03:24 pts/153 0:02 /u/recital/db.exe -x tntbw

from here you will see that the session login at 8:18, it's probably inactive due to user accidentally close the screen.

If under normal circumstances, when you do a who, it should show 2 active users only, but the ps -ef will still show 3 session, at least from who will tell there are only 2 active users.

Is there any command that can output that only inactive or active session ?

Thanks & Rgds
T.W.Low