Logged in users on a Linux server are counted twice


 
Thread Tools Search this Thread
Operating Systems Linux Logged in users on a Linux server are counted twice
# 1  
Old 01-27-2015
Logged in users on a Linux server are counted twice

Scenario:
  1. Log into a linux server interface as root.
  2. Inititiate an SSH session with the server using Putty and a valid user account (e.g. fakeuser).
  3. Log into TTY2 of the linux server interface using another valid user account (e.g. faketester).

Issue:
With these three login sessions, the linux server reports that there are five (5) users logged into the server and lists the users as:
Code:
faketester 
fakeuser 
fakeuser 
faketester 
root

The TTY2 and SSH sessions are counted twice.
I am testing this on a RHEL6.5

Last edited by rbatte1; 01-28-2015 at 08:13 AM.. Reason: Added LIST=1 and CODE tags
# 2  
Old 01-27-2015
How are you listing users? Check the 'tty' using 'ps -ef' to see how many processes are on each session.
# 3  
Old 01-27-2015
who shows logged in users. ps and other tools show processes (can be many for one user), not logins. su - username is not counted as a login by who.
# 4  
Old 01-28-2015
I did try the who command and this was the result .Notice the time stamp .


Code:
faketester tty2 Jan 27 13:17 
fakeuser pts/2 Jan 27 13:21 (XX.X.XXX.XXX) 
fakeuser pts/3 Jan 27 13:21 
faketester pts/0 Jan 27 13:17 (:tty2:S.0) 
root pts/1 Jan 27 13:15 (:tty1:S.0)


Last edited by rbatte1; 01-28-2015 at 12:02 PM..
# 5  
Old 01-28-2015
who reads the /var/log/utmp (and others) file for login information.
So, I cannot assume anything but that those are valid login records.

The only way to test that is to manually kill off the fake* family of process, run who to be sure you got them all, log on ONCE using faketester, verify with who. If this pans out, then you need to consider who output authoritative. It always is unless some process tinks with files in /var/log.

Go from that point with your experimenting.
# 6  
Old 01-28-2015
Thank you for your response !
So I killed all the processes run by any user other than root .
I closed all sessions except one with root logged in and I started another session with user "faketester"

output of the who command

Code:
root tty1 Jan 23 14:46
root pts/1 Jan 28 14:35 (XX.X.XX.XXX)
root pts/2 Jan 28 14:35
faketester pts/3 Jan 28 14:52 (XX.X.XX.XXX)
faketester pts/4 Jan 28 14:52

output of ps -ef | grep fake*

Code:
4 S root 10314 2034 0 80 0 - 23564 unix_s 14:52 ? 00:00:00 sshd: faketester [priv]
5 S 2002 10320 10314 0 80 0 - 23564 poll_s 14:52 ? 00:00:00 sshd: faketester@pts/3
0 S 2002 10321 10320 0 80 0 - 2571 n_tty_ 14:52 pts/3 00:00:00 /usr/bin/script -q -a /var/log/logins/20152801145227_faketester_scr ipt_10321
1 S 2002 10347 10321 0 80 0 - 2572 n_tty_ 14:52 pts/3 00:00:00 /usr/bin/script -q -a /var/log/logins/20152801145227_faketester_scr ipt_10321
0 R root 10366 10036 0 80 0 - 1595 - 14:54 pts/2 00:00:00 grep fake*

Why do the processes that are in bold happen twice ? do you think that might be the issue ?
Moderator's Comments:
Mod Comment Please use CODE tags when showing sample input, sample output, and code segments.

Last edited by Don Cragun; 01-28-2015 at 07:50 PM.. Reason: Add CODE and ICODE tags.
# 7  
Old 02-05-2015
Logged in users on a RHEL server are counted twice

I have "root" logged in on the console and when I bash login as "faketester" it appears twice when i run the "who" command

Code:
#who
faketester pts/0        Feb  5 15:17 (XX.X.XX.XXX)
faketester pts/1        Feb  5 15:17
root     pts/2        Feb  5 15:17 (:tty1:S.0)

Code:
ps -ef | grep fake*
root      2001  1790  0 15:17 ?        00:00:00 sshd: faketester [priv]
2002      2007  2001  0 15:17 ?        00:00:00 sshd: faketester@pts/0
2002      2008  2007  0 15:17 pts/0    00:00:00 /usr/bin/script -q -a /var/log/logins/20150502151754_faketester_script_2008
2002      2034  2008  0 15:17 pts/0    00:00:00 /usr/bin/script -q -a /var/log/logins/20150502151754_faketester_script_2008
2002      2080  2035  0 15:25 pts/1    00:00:00 grep fake*

I have narrowed it down to
Code:
/etc/profile

being called twice for an ssh interactive login. I am trying to figure out what calls /etc/profile and how do I stop it from being called twice so an additional user isn't created.

Thanks in advance !

Last edited by walterthered; 02-05-2015 at 05:34 PM..
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Red Hat

Logged in users on a Linux server are counted twice

Scenario: 1. Log into a linux server interface as root. 2. Inititiate an SSH session with the server using Putty and a valid user account (e.g. fakeuser). 3. Log into TTY2 of the linux server interface using another valid user account (e.g. faketester). Issue: With these three login... (1 Reply)
Discussion started by: walterthered
1 Replies

2. Shell Programming and Scripting

Total number of users logged in a server from uptime

how to find out total number of users logged in a server from uptime . i mean to say i need the total output of unix command . who gives the out put at a particular time . I need at all time from which machine who has connected , (3 Replies)
Discussion started by: amiya.te@gmail
3 Replies

3. Red Hat

Current logged in users

I have 2 systems. (1) RHEL5 and (2) winXP pro from xpPRO putty i ssh into rhel5 : user root from xpPRO i ftp into rhel5 : user abc123 when i run #uptime it only shows 1 user when i do #ps -u abc123 : it shows vsftpd deamon PID is there a command that can be used to show all currently... (4 Replies)
Discussion started by: dplinux
4 Replies

4. UNIX for Dummies Questions & Answers

How many users are logged in?

How do I find this out? I have a feeling its a simple command such as who, but I just don't know what it is. I've had a search on here but either I can't put it into the right search criteria or there isn't a topic on it. Thanks. EDIT: Delete this thread, as I posted it I noticed the... (0 Replies)
Discussion started by: chris_rabz
0 Replies

5. Shell Programming and Scripting

Users Not Logged in

I have searched the forums but have not mangaed to quite find what im looking for. I have used to /etc/passwd command to present me a list of all users the who command to present all users currently logged on, but what i want to know is what command can i use to display users that are registered... (12 Replies)
Discussion started by: warlock129
12 Replies

6. Post Here to Contact Site Administrators and Moderators

logged out users

how to find out users who logged out within 5 minutes (1 Reply)
Discussion started by: roshni
1 Replies

7. Shell Programming and Scripting

how many users logged

in unix what is the syntax to find out how many users are currently logged in (4 Replies)
Discussion started by: trichyselva
4 Replies

8. IP Networking

Users logged in through which NIC

We have two NIC cards in our IBM RS/6000 F50 running AIX 4.3.3 We are trying to make sure we have moved all users to log in through the new NIC. 10.22.x.y (old) 10.22.x.z (new) How can I tell which users are still using the old address for logging in so I can update their work station to... (5 Replies)
Discussion started by: cburtgo
5 Replies

9. IP Networking

All tcp/ip users are logged out

I have an RS6000 server running AIX and on occasion all users are logged out of the server "connection closed by foreign host" is the error message. Normally a user can press enter and get a Login prompt, but they get the message "connection refused" and then the users can wait a minute or so and... (2 Replies)
Discussion started by: Docboyeee
2 Replies

10. UNIX for Advanced & Expert Users

Migrating all users from one linux server to another...

Hello, I've been tasked with migrating users from one linux server to another new linux server. This is how I was thinking of doing it: 1.) Open up an NFS connection between the two servers, cp -Rp /home/ to the new server and then append the old /etc/group & /etc/passwd to the existing... (2 Replies)
Discussion started by: vancouver_joe
2 Replies
Login or Register to Ask a Question