I have observed that an entrance takes place in the file utmp in a wrong registry. A user appears in the ud file entrance and when it logs-off the system is not updated because it's not in the right place. This causes that the user appears as logged and he's not (the who command reports the user in the system but the w does not!). I have noticed this error in the versions 5.1 and 5.2 with kernel 2.0.36 and 2.0.38. Since I have pam_limits activated, the mentioned situation generates a problem because I have the maximum number of log-ins set to one. The utmdump looks like this: [8][00008][si ][ ][ ][Oct 2 08:42:30] [1][20019][~~ ][runlevel][~ ][Oct 2 08:42:30] [8][00079][l3 ][ ][ ][Oct 2 08:42:39] [7][00377][ud ][vaxsi ][ttyC10 ][Oct 5 14:42:08] ^ |----- ERROR ------------- [6][12908][1 ][LOGIN ][tty1 ][Oct 6 19:57:32] [5][12030][2 ][ ][ ][Oct 6 19:53:15] [6][10183][3 ][LOGIN ][tty3 ][Oct 4 20:01:44] [6][10181][4 ][LOGIN ][tty4 ][Oct 4 20:01:42] [6][10179][5 ][LOGIN ][tty5 ][Oct 4 20:01:40] [6][02192][6 ][LOGIN ][tty6 ][Oct 4 19:15:07] [7][00384][s0 ][funatec ][ttyS0 ][Oct 2 08:44:38] [7][01177][s1 ][funatec ][ttyS1 ][Oct 2 08:51:34] [5][09512][z0 ][ ][ ][Oct 2 09:46:01] [7][29441][z1 ][cepkay ][ttyC1 ][Oct 7 08:17:44] [5][31314][z2 ][ ][ ][Oct 7 08:25:44] [5][30931][z3 ][ ][ ][Oct 7 08:24:03] [7][30438][z4 ][milk ][ttyC4 ][Oct 7 08:22:48] [7][25554][z5 ][taap ][ttyC5 ][Oct 7 07:58:10] [5][03152][z6 ][ ][ ][Oct 5 20:21:42] [5][31196][z7 ][ ][ ][Oct 7 08:24:49] [5][30850][z8 ][ ][ ][Oct 7 08:23:02] [7][24303][z9 ][copiara ][ttyC9 ][Oct 7 07:46:25] [5][31135][za ][ ][ ][Oct 7 08:24:42] [7][30909][zb ][futuro ][ttyC11 ][Oct 7 08:24:37] [7][23338][zc ][estabb ][ttyC12 ][Oct 7 07:34:16] [7][29337][zd ][junior ][ttyC13 ][Oct 7 08:19:52] [5][31367][ze ][ ][ ][Oct 7 08:25:47] [7][29556][zf ][enrique ][ttyC15 ][Oct 7 08:20:48] [7][27636][z10 ][tapro ][ttyC16 ][Oct 7 08:10:49] [7][25392][z11 ][alcabb ][ttyC17 ][Oct 7 07:54:18] [5][30703][z12 ][ ][ ][Oct 7 08:22:41] [5][18679][z13 ][ ][ ][Oct 6 20:36:31] [7][09183][z14 ][inteba ][ttyC20 ][Oct 2 15:29:28] [7][05758][z15 ][tusar ][ttyC21 ][Oct 2 09:21:31] [7][11056][z16 ][albb ][ttyC22 ][Oct 5 15:36:08] [7][17636][z17 ][cereal ][ttyC23 ][Oct 6 17:34:35] [8][25950][p0 ][ ][ttyp0 ][Oct 5 12:16:50] [7][31227][p1 ][aboland ][ttyp1 ][Oct 7 08:25:15]
This is fixed in the current red Hat Linux release