Bug 1987
Summary: | finger has wtmp problems | ||
---|---|---|---|
Product: | [Retired] Red Hat Raw Hide | Reporter: | Jay Freeman <saurik> |
Component: | finger | Assignee: | Crutcher Dunnavant <crutcher> |
Status: | CLOSED CURRENTRELEASE | QA Contact: | |
Severity: | low | Docs Contact: | |
Priority: | low | ||
Version: | 1.0 | CC: | ysyi |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | i386 | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 1999-04-08 19:12:04 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Jay Freeman
1999-04-04 20:08:56 UTC
Can you make sure that you are running util-linux-2.9o? There's a fix in login to get the tty slot correct on network connections. (before I go wtmp diving :-) You might also look at utmpdump ... [root(5)@ironclad /etc]# utmpdump Utmp dump of /var/run/utmp [root(5)@ironclad /etc]# rpm -q util-linux util-linux-2.9o-6 # Couldn't find a manual page for utmpdump or even its binary (and it isn't in bash's man page) :(. Ok, I think I figured out how this would be used, these three lines were right after each other: [7] [03377] [/1 ] [saurik ] [pts/1 ] [Apr 3 15:50:47] [7] [05982] [/3 ] [saurik ] [pts/3 ] [Apr 3 17:12:14] [7] [06477] [/3 ] [saurik ] [pts/3 ] [Apr 3 17:20:26] Note the lack of a logout for 05982 right before the login of 06477 on the same terminal. I know that this isn't from nscd because I stopped using nscd at 14:40 (checked my logs from IRC where I mentioned the problem). I just tried logging out of one of the terminals that I had open that was valid, and it was not logged either (and is now showing up with finger). After examining the utmpdump of wtmp and checking my syslog I got: [root(6)@ironclad log]# tail messages -n 4 Apr 4 15:49:13 ironclad PAM_pwdb[10837]: (login) session closed for user saurik Apr 4 15:49:39 ironclad PAM_pwdb[23667]: (login) session opened for user saurik by saurik(uid=0) Apr 4 15:49:39 ironclad pam_console[23667]: did not find console 1 Apr 4 15:49:39 ironclad -- saurik [23667]: LOGIN ON 1 BY saurik FROM saurik [root(6)@ironclad log]# utmpdump wtmp | tail -n 2 [5] [21786] [pu ] [ ] [ ] [Apr 4 10:55:19] [7] [23667] [/1 ] [saurik ] [pts/1 ] [Apr 4 15:49:39] "who" shows the same problems... The problem here is that there are several packages that need to interact in order to get finger info correct. First, utmpdump can be used to display a wtmp like file such as /var/run/utmp, /var/run/utmpx, and /var/log/wtmp. A first field of [7] indicates a USER_PROCESS, while an [8] indicates a DEAD_PROCESS (i.e. logged off). See entries of the same name in /usr/include/bits/utmp.h for the complete list. Second, the utmp entries are mainly written by login (for login, rlogin, and telnet) or from a package called utempter (for xterm, screen, possibly others). The records are often accessed by a legacy field that utempter was not setting correctly, so you need to upgrade to (at least) utempter-0.5-1. Thirdly, much code like finger (and possibly who) is going to break because of new names for pseudo tty devices. The old names looked like ttypX (with id "pX") while new names look like pts/X (with id "/X"). This has been (at least partially) fixed in finger-0.10-24. Lastly, there is the likelihood that, with all these component changes, that you will have broken utmp entries lying around. Doing cp /dev/null /var/run/utmp cp /dev/null /var/run/utmpx cp /dev/null /var/log/wtmp (probably not necessary). and rebooting is necessary to eliminate bogus entries. Please reopen this bug if you have further problems. *** Bug 3060 has been marked as a duplicate of this bug. *** `finger` prints "/<num>" as the user's tty (if on a pty, that is), instead of "pts/<num>" (on 2.2 kernels with "Unix98 PTY" support, which 6.0 ships with). Not much of a bug, but somewhat lame. A patch for this can be found at: http://async.org/~ysyi/rh6finger.pts.diff if you're so inclined to fix it... ------- Additional Comments From jbj 06/02/99 08:10 ------- Could you reply to this message with patch attached? I can't seem to access the URL. Thanks. |