Red Hat Bugzilla – Bug 1987
finger has wtmp problems
Last modified: 2008-05-01 11:37:49 EDT
I believe this might be related to my nscd problem which I
posted earlier (bug #1979). I seem to have various residual
entries in /var/log/wtmp which are logins that got frozen
and then didn't log out properly. w pays no leave of these,
and lists correct information. finger however attempts to
show information on these logins, and then has extra
problems because the terminal's don't exist in the pts
filesystem because they were unallocated. It brings up a
couple complaint errors about missing files then continues,
marking the messed up files with a * right before the Tty
[root(2)@ironclad c7]# w
2:37pm up 23:08, 5 users, load average: 0.00, 0.04,
USER TTY FROM LOGIN@ IDLE JCPU
saurik pts/4 saurik Sat 6pm 16.00s 0.51s
0.07s screen -r
saurik pts/5 saurik Sat 6pm 9:39 13.09s
0.06s vi ftpaccess
saurik pts/6 saurik Sat 7pm 0.00s 2.45s
[root(2)@ironclad c7]# finger
finger: /dev//pts/1: No such file or directory
finger: /dev//pts/3: No such file or directory
Login Name Tty Idle Login Time Office
saurik Jay Freeman *pt Apr 3 15:50 (saurik)
saurik Jay Freeman *pt Apr 3 17:20 (saurik)
saurik Jay Freeman pt Apr 3 18:29 (saurik)
saurik Jay Freeman pt Apr 3 18:32 (saurik)
saurik Jay Freeman pt Apr 3 19:59 (saurik)
Can you make sure that you are running util-linux-2.9o? There's
a fix in login to get the tty slot correct on network connections.
(before I go wtmp diving :-) You might also look at utmpdump ...
[root(5)@ironclad /etc]# utmpdump
Utmp dump of /var/run/utmp
[root(5)@ironclad /etc]# rpm -q util-linux
# Couldn't find a manual page for utmpdump or even its binary (and it
isn't in bash's man page) :(.
Ok, I think I figured out how this would be used, these three lines
were right after each other:
  [/1 ] [saurik ] [pts/1 ] [Apr 3 15:50:47]
  [/3 ] [saurik ] [pts/3 ] [Apr 3 17:12:14]
  [/3 ] [saurik ] [pts/3 ] [Apr 3 17:20:26]
Note the lack of a logout for 05982 right before the login of 06477 on
the same terminal. I know that this isn't from nscd because I stopped
using nscd at 14:40 (checked my logs from IRC where I mentioned the
I just tried logging out of one of the terminals that I had open that
was valid, and it was not logged either (and is now showing up with
finger). After examining the utmpdump of wtmp and checking my syslog
[root(6)@ironclad log]# tail messages -n 4
Apr 4 15:49:13 ironclad PAM_pwdb: (login) session closed for
Apr 4 15:49:39 ironclad PAM_pwdb: (login) session opened for
user saurik by saurik(uid=0)
Apr 4 15:49:39 ironclad pam_console: did not find console 1
Apr 4 15:49:39 ironclad -- saurik
: LOGIN ON 1 BY saurik FROM saurik
[root(6)@ironclad log]# utmpdump wtmp | tail -n 2
  [pu ] [ ] [ ] [Apr 4 10:55:19]
  [/1 ] [saurik ] [pts/1 ] [Apr 4 15:49:39]
"who" shows the same problems...
The problem here is that there are several packages that need to
interact in order to get finger info correct.
First, utmpdump can be used to display a wtmp like file such
as /var/run/utmp, /var/run/utmpx, and /var/log/wtmp.
A first field of  indicates a USER_PROCESS, while an 
indicates a DEAD_PROCESS (i.e. logged off). See entries
of the same name in /usr/include/bits/utmp.h for the complete
Second, the utmp entries are mainly written by login (for
login, rlogin, and telnet) or from a package called utempter (for
xterm, screen, possibly others). The records are often accessed
by a legacy field that utempter was not setting correctly, so
you need to upgrade to (at least) utempter-0.5-1.
Thirdly, much code like finger (and possibly who) is going to
break because of new names for pseudo tty devices. The old
names looked like ttypX (with id "pX") while new names look
like pts/X (with id "/X"). This has been (at least partially) fixed
Lastly, there is the likelihood that, with all these component
changes, that you will have broken utmp entries lying around.
cp /dev/null /var/run/utmp
cp /dev/null /var/run/utmpx
cp /dev/null /var/log/wtmp (probably not necessary).
and rebooting is necessary to eliminate bogus entries.
Please reopen this bug if you have further problems.
*** Bug 3060 has been marked as a duplicate of this bug. ***
`finger` prints "/<num>" as the user's tty (if on a pty,
that is), instead of "pts/<num>" (on 2.2 kernels with
"Unix98 PTY" support, which 6.0 ships with). Not much of a
bug, but somewhat lame.
A patch for this can be found at:
if you're so inclined to fix it...
------- Additional Comments From firstname.lastname@example.org 06/02/99 08:10 -------
Could you reply to this message with patch attached? I can't seem
to access the URL.