AIX

Hi,

I have a problem with a server which doesn't stop some sessions.
It looks a ghost sessions.
I don't have defunct process.
I can't find some processes which are executing with the session t41 and t49...
Every time, I have to reboot the server to stop those sessions...
If someone have some clues to help me...

AIX 5.2 is rather old and not supported anymore. Maybe this is a problem related to the OS, sshd or telnetd, whatever these listed logins are related to.
Maybe make sure you go at least to the latest ML that is available for 5.2.

These are just interactive sessions where the user has disconnected untidily. The information is coming from the utmp file. The same file as is used by the who -u command.
A reboot will indeed clear them (because this starts a new utmp file) but they are totally harmless if they are not actually running any processes.

methyl is correct. The "ghost sessions" are just entries in the "/var/adm/utmp" file and could be ignored.

If you still want to clean that up you could try to "zap" the utmp file.

CAUTION: NEVER delete this file! This file is open and you must not delete files opened by processes. The reason is that deleting/recreating the file will give it another inode (you can try that with a temporary file and using ls -i displaying the inode number) and hence make it impossible for the process(es) to find it.

The way to delete open files while preserving their inode is to what i call "zapping": copy the content of "/dev/null" (which contains an End-Of-File marker) to it, reducing the length to zero:

Code:

cat /dev/null > /var/adm/utmp

This might solve your problem without a reboot, but i have no 5.2-system to verify it. You will have to try.

I hope this helps.

bakunin

I think that nulling the utmp file will only make things worse because it will orphan the current logged-in users records. Utilities like uptime would stop working. You can see what's in your utmp file with the fwtmp utility (even though it is intended for the wtmp file).

You are right. On the other hand as users log out and log in again this will become corrected over time. Depending on how much and which type of (long-lasting or short) user sessions the system typically experiences this may take a tolerable amount of time.

Btw., it is a good idea to temporarily disable logins for safety while working on the utmp file. This can be done by creating an empty file /etc/nologin as root. The simple existence of the file prevents logins, removal of it (which is done automatically at reboot too) will reenable logins.

I hope this helps.

bakunin