I think this is either going the wrong way, or maybe I'm not understanding what's being said.

The "idle process" you are talking about is not telnet or the shell, but rather an instance of the application that's being run through said telnet session, right?

In other words:
User telnets to box, starts application.
User closes terminal without properly exiting application.
User's session terminates, but application process keeps on running.

And what you want to find out is how to differenciate those application processes that are still running that where not properly shut down when the user terminated his telnet session, so you can safely kill them. Right?

If that's the case, i.e., the application process doesn't die when the telnet session is killed, then loking at user idleness is not going to help, since there actually won't be a user session associated with said application process.

I'd say first that I agree with what grial said - the app should catch ithe session being terminated -, anyway, without knowing specifics - and you know the devil is in the details -, I'd think that a simple parse of ps -ef would do the trick. Rather than looking for idle sessions, you can match PID's with a simple script. Quick example:

user1 logs in, so it creates some processes. One of the is the user's shell. When that user starts some application, that application process should show the user's shell as the application process' parent ID. I would think a simple match of said IDs in a cron job would do the trick; something like:

Code:

process=$(ps -ef | grep <my_application_process> | awk '{print $2}') 
parent=$(ps -ef | grep <my_application_process> | awk '{print $3}') 
count=$(ps -ef | grep ${parent} | wc -l)  ## this should catch at least 2 processes: 
                                          ## the PPID of application and the PID of
                                          ## user's shell
if (( ${count} < 2 )); then  ## if it only catches one, it'd mean user is no longer logged in
kill -9 ${process}
fi

Now, the above example is very simplified. You'd probably need to play around with arrays and other stuff, but hopefully it gives you the idea.

And, like I said before, if I misunderstood what's being asked, then, nevermind