I recently did a fresh install of RH 7.3, and I began to notice that the logins
reported by "w" would often become garbled when I checked them at random points
during the day. By "garbled", I mean that some entries were missing despite an
active login (at the tty or a telnet session) and some of the values in
the "FROM" columns were out of place. (an IP address on a real tty!). I
couldn't easily reproduce the problem, because whenever I tested logging in and
logging out it seemed to produce and remove the proper w entries. However, I
did set up a "w" logger which would write a w entry to a file every second, so
that I could see what was happening. I observed in the log that at
approximately 8:12 PM today (with 10 logins present, most from the console), a
login from a remote computer through telnet to /dev/pts/1 literally "replaced"
a "w" entry for /dev/tty1 which had been logged in and idle for 9 hours. In
other words, when I logged in remotely through telnet, and while the console
was not in use (with /dev/tty1 and /dev/tty2 idle, tty1 in pico, tty2 in a
shell), the /dev/pts/1 login appeared as the /dev/tty1 login was removed (in
the first position). A few moments later, I connected a second time from the
same host, and this time /dev/tty2 was vaporized. Both console terminals
remained logged in and functioning, but are not shown at all in "w", even after
the remote sessions had been terminated.
This seems to happen randomly, since when I test it now, it performs properly,
as it has every other time I've tested it manually.
Would be useful to know if this still happens with the Limbo beta