Subject: Re: bug#21349: who shows no users (looking in wrong place)

From: "L. A. Walsh" <[email-masked]>
Date: Sun, 27 Dec 2015 13:35:12 -0800

Erik Auerswald wrote:
>
> Linda A. Walsh noticed a similar thing:
>   
>> The same thing happens on openSuSE
>>     
----

Looked into this a bit more and found that while
'w' and 'who' didn't work, "last" did.

Tracked it down to this...
from the linux programmer's manual UTMP(5)

it says conforming implementations should look in:
FILES
       /var/run/utmp
       /var/log/wtmp
--------------

tracing who (I assume 'w' uses similar code):
# strace who|& grep /var
access("/var/run/utmpx", F_OK)          = -1 ENOENT (No such file or 
directory)
open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or 
directory)
access("/var/run/utmpx", F_OK)          = -1 ENOENT (No such file or 
directory)
open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or 
directory)
----

I.e. it isn't checking the 2nd location.

Adding a link in the *ephemeral* (tmpfs/ramdisk) /var/run allows
it to temporarily work:

# ln -s ../log/wtmp utmp

>  who
law      pts/0        2015-11-29 09:49 (athenae)
root     tty1         2015-12-22 09:26
law      pts/1        2015-12-23 16:57 (athenae)
law      pts/0        2015-12-25 17:46 (athenae)
law      pts/2        2015-12-25 21:42 (athenae)
law      pts/4        2015-12-25 22:23 (athenae)
law      pts/5        2015-12-27 08:46 (athenae)
law      pts/6        2015-12-27 12:54 (athenae)
law      pts/7        2015-12-27 12:59 (athenae)
>  w
 13:18:22 up 108 days, 21:03, 459 users,  load average: 1.33, 1.25, 0.99
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
law      pts/0    athenae          29Nov15 39:52m  6:38   1.18s 
dovecot/imap [l
root     tty1                      Tue09    3days  0.28s  0.28s -bash
law      pts/1    athenae          Wed16    2days  0.30s  0.30s -bash
law      pts/0    athenae          Fri17   39:52m  6:38   1.11s -bash
law      pts/2    athenae          Fri21   37:18m  0.42s  0.42s -bash
law      pts/4    athenae          Fri22   38:52m  0.25s  0.25s -bash
law      pts/5    athenae          08:46    1:39m  0.57s  0.57s -bash
law      pts/6    athenae          12:54   12:44   0.37s  0.37s -bash
law      pts/7    athenae          12:59    0.00s  0.29s  0.01s w
>  last|grep 'still log'
law      pts/7        athenae          Sun Dec 27 12:59   still logged in  
law      pts/6        athenae          Sun Dec 27 12:54   still logged in  
law      pts/5        athenae          Sun Dec 27 08:46   still logged in  
law      pts/4        athenae          Fri Dec 25 22:23   still logged in  
law      pts/2        athenae          Fri Dec 25 21:42   still logged in  
law      pts/0        athenae          Fri Dec 25 17:46   still logged in  
law      pts/1        athenae          Wed Dec 23 16:57   still logged in  
root     tty1                          Tue Dec 22 09:26   still logged in

----------------------------------------------

While creating a symlink in /var/run/utmp => /var/log/wtmp
is a per-boot, workaround to get this to work until 'w/who' are fixed,
both of them should check the linux-standard locations documented
in the manpage.

Likely /var/log is a new location (as /var/run was made ephemeral
as part of the transition to systemd).  Note, there was some
pressure by the systemd folks to also make /var/log ephemeral
as well as /tmp and /var/tmp, but those were resisted, at least
in "SUSE"...(at least for now...), since the default for systemd
is to not store or save logfiles (or coredumps) over boots.

One can tell from design choices like that systemd is designed for
end-consumer systems, where logs that document things might
be inconvenient (vs. any publicly owned corporation, law group
bank or medical office where retaining logs for some period
of time is required by US law).