UNIX for Dummies Questions & Answers

Does anyone know how to do that ??? When I typed "w", I didn't see the user then I did "who", the user displayed but somehow his IP was invisible

Thx in advnace

To show up in w, you need a running login shell and an associated utmp entry. To show up in who you need a utmp entry. Improper shutdowns or killing proceses with a -9 will leave daggling utmp entries.

Programs like xterm can establish a session without creating a utmp entry. Do a ps -ef and look for login shells. These will be listed as -sh, -ksh, -csh, etc. If the ppid is not 1, this shell logged in over the network. Use lsof on the parent to find the ip address.

Call me stupid but I did take the look at the PID and have no idea which one belong to that user ? (the server is Redhat 7.2)
Somehow, that username didnt show up

Anyway, I'm not trying to find IP, but because I never seen it before, I really want to know how to do that . So Perderabo, are you saying that xterm is a possible answer ? And is there any script or program that can let me do that too ???

I'm lost here, I'm not sure which goofy thing you want to do. If you want to create a session that doesn't show up in who or w, then yes, xterm is an answer. And xterm is a program. You need to run xterm with the -ut option which may be your default. Or you can use +ut to ensure that you do show up in who or w. Fair warning, it is fairly easy to produce a list of such sessions and there is no way to hide your processes from ps.

The idea of this option is that you should have one window that does show up in who/w. That window would be used for talk, etc. But as you open secondary windows, you should inhibit the utmp entry to avoid cluttering up the who/w output.

Leaving a dangling utmp entry is harder, you have to kill the program that would have cleanup it up. That requires root.

Now, how can it be that you saw a pid, but you didn't know the user? Let's try an example... I can get a list of all users on the box who use bash with:
ps -ef | grep " -bash"
One of the lines is
joeblow **** 30014 30013 ** 0 12:27 pts/1 *** **** 00:00:00 -bash

In this case "joeblow" is the user. 30014 is the pid of his shell (pid). 30013 is the pid of the parent of his shell (ppid).

I know that, but somehow that username didn't show up . Umm, maybe he su root

I want to do the same thing he did . Anyway, thx u so much for taking your precious time to explain . I'll try that tomorrow...need to get some sleep now