GNU bug report logs - #8643
'who' command bug

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 8643 in the body.
You can then email your comments to 8643 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: ding bat <dingbat.trash <at> gmail.com>
To: bug-coreutils <at> gnu.org
Subject: 'who' command bug
Date: Tue, 10 May 2011 15:29:27 -0400

[Message part 1 (text/plain, inline)]

I was using Who to list all users connected to pptpd vpn server with
maverick 10.10.
I put natty on the computer and now the who command does not list out the
vpn users. It only seems to list out local logged in user.
any thoughts,.... this issue is killing me.....
I can still do 'last |grep ppp' and get joy, but 'w' and 'who' were very
nice.

-danny

[Message part 2 (text/html, inline)]

Message #8 received at 8643 <at> debbugs.gnu.org (full text, mbox):

From: Bob Proulx <bob <at> proulx.com>
To: ding bat <dingbat.trash <at> gmail.com>
Cc: 8643 <at> debbugs.gnu.org
Subject: Re: bug#8643: 'who' command bug
Date: Tue, 10 May 2011 17:05:33 -0600

ding bat wrote:
> I was using Who to list all users connected to pptpd vpn server with
> maverick 10.10.
> I put natty on the computer and now the who command does not list out the
> vpn users. It only seems to list out local logged in user.
> any thoughts,.... this issue is killing me.....
> I can still do 'last |grep ppp' and get joy, but 'w' and 'who' were very
> nice.

Thanks for reporting this and trying to improve the system.  That is
great!  However this isn't a bug in who.  We are going to need to find
the particular program and then report the problem there.  Let me
explain...

The 'who' command lists out data from the utmp file (/var/run/utmp on
most GNU/Linux systems).  It is simply the messenger that is reporting
what has been logged there.  If the data is logged then it reports it.
If it is not logged then it doesn't have anything to report.  Being
just the messenger it often gets the blame when other programs don't
log data there but it isn't the fault of the who program.

The data about who is logged into a system is logged by programs that
log users into the system.  For example traditionally the /bin/login
program would write this information there.  But rarely do users use
/bin/login anymore.  These days it is usually ssh logins from the
network or xdm/gdm/kdm from the console.  You are probably talking
about gdm logins from the console on your system.

In my case on my system I log in using xdm and then start several
xterms.  Each xterm logs utmp information when it is started.  There
is an xterm option to prevent this logging but it is on by default.
Whatever is logged is reported by the who command (and others such as
finger and w).  Please try starting an xterm and I am sure you will
see that xterm logs this information to the utmp file and later this
is reported by the who command.

At various times people report the same issue that you are reporting,
that some programs log this data and that other programs do not log
this data.  At other times people report the opposite case as a bug
that they *do* log this data and that it creates too much noise.  They
claim that all of the terminals by one user are really just one user
login.  I imagine you are caught in the latter case having caused the
opposite change.

I am not an Ubuntu user and do not have a system to test with and so I
do not know what programs you would be running when you log in with
Ubuntu's Natty.  You will need to look at your system and determine
what login manager you are using.  This is probably gdm but might be
gdm3 but possibly one of several others.  You will need to determine
what terminal program you are using.  This is probably gnome-terminal
but possibly one of several others.  Both of those programs either
should (or should not) be logging user login information to utmp.

I imagine that you will want to look closely at the gnome-terminal
documentation and news entries to see if it has purposefully stopped
logging to utmp.  (Assuming that gnome-terminal is what you are
using.)  There may be an option to enable it again.  If not then I
imagine you will want to file a bug report with them about it.

In the meantime since this isn't a bug in 'who' I am going to mark it
as not a bug and then close it so that the long list of bugs in the
bug tracker doesn't get overwhelmed.

Please don't take the fact that the bug is closed to mean that we
don't want any more discussion.  The opposite is true.

If possible please report back to us on what you find.  Please feel
free to keep posting followups.  It will continue to be tracked in the
bug log.  This will help others who read through it later.  At any
time the bug can be opened again if needed.

Thanks,
Bob

Message #15 received at 8643 <at> debbugs.gnu.org (full text, mbox):

From: "Alan Curry" <pacman-cu <at> kosh.dhis.org>
To: dingbat.trash <at> gmail.com (ding bat)
Cc: 8643 <at> debbugs.gnu.org
Subject: Re: bug#8643: 'who' command bug
Date: Tue, 10 May 2011 18:15:01 -0500 (GMT+5)

Bob Proulx writes:
> 
> ding bat wrote:
> > I was using Who to list all users connected to pptpd vpn server with
> > maverick 10.10.
> > I put natty on the computer and now the who command does not list out the
> > vpn users. It only seems to list out local logged in user.
> > any thoughts,.... this issue is killing me.....
> > I can still do 'last |grep ppp' and get joy, but 'w' and 'who' were very
> > nice.
[...]
> I am not an Ubuntu user and do not have a system to test with and so I
> do not know what programs you would be running when you log in with
> Ubuntu's Natty.  You will need to look at your system and determine
> what login manager you are using.  This is probably gdm but might be
> gdm3 but possibly one of several others.  You will need to determine
> what terminal program you are using.  This is probably gnome-terminal
> but possibly one of several others.  Both of those programs either
> should (or should not) be logging user login information to utmp.

Bob apparently doesn't know what pptpd is. Or what "VPN" means. Or what PPP
is. Or didn't read very carefully.

But he's probably right anyway. The bug is more likely to be in pppd than
anywhere else. It's weird that it would write to wtmp (for last) but not utmp
(for who). Check the config files for recent changes, and if you can't find
the cause, find someplace that gives help with pppd.

An strace of the pppd process during connection setup could be enlightening.

-- 
Alan Curry

Message #18 received at 8643 <at> debbugs.gnu.org (full text, mbox):

From: Bob Proulx <bob <at> proulx.com>
To: ding bat <dingbat.trash <at> gmail.com>
Cc: 8643 <at> debbugs.gnu.org
Subject: Re: bug#8643: 'who' command bug
Date: Wed, 11 May 2011 14:56:08 -0600

Alan Curry wrote:
> Bob Proulx writes:
> > ding bat wrote:
> > > I was using Who to list all users connected to pptpd vpn server with
> > > maverick 10.10.
> > > I put natty on the computer and now the who command does not list out the
> > > vpn users. It only seems to list out local logged in user.
> > > any thoughts,.... this issue is killing me.....
> > > I can still do 'last |grep ppp' and get joy, but 'w' and 'who' were very
> > > nice.
> [...]
> > I am not an Ubuntu user and do not have a system to test with and so I
> > do not know what programs you would be running when you log in with
> > Ubuntu's Natty.  You will need to look at your system and determine
> > what login manager you are using.  This is probably gdm but might be
> > gdm3 but possibly one of several others.  You will need to determine
> > what terminal program you are using.  This is probably gnome-terminal
> > but possibly one of several others.  Both of those programs either
> > should (or should not) be logging user login information to utmp.
> 
> Bob apparently doesn't know what pptpd is. Or what "VPN" means. Or what PPP
> is. Or didn't read very carefully.

Or all of the above.  Or some of the above.  Not being a MS windows
user I have never used, nor needed to use, 'pptpd'.  I am very
familiar with VPNs on Unix and GNU systems and have set up and
maintain several.  I am using a VPN at this moment to answer this
message.

But I admit I didn't read that message carefully enough and missed the
comment that pptpd wasn't logging to utmp anymore.  I had assumed that
it was another report that terminals weren't logging users and that
was a wrong assumption.  Thanks for catching that item.

> But he's probably right anyway.

Figher pilots have an old say, "It is better to be lucky than good." :-)

> The bug is more likely to be in pppd than anywhere else. It's weird
> that it would write to wtmp (for last) but not utmp (for who). Check
> the config files for recent changes, and if you can't find the
> cause, find someplace that gives help with pppd.
>
> An strace of the pppd process during connection setup could be enlightening.

Agreed.

ding bat wrote:
> First, many thanks for such a great response. to be honest, I did not
> expect anyone to answer, or care about such a topic.

But of course!  It is a friendly development group.

> Anyway, I did some poking around and found out that pptpd (poptop vpn
> server) is likely logging users into the wtmp. I know that the users
> are specified in the Chaps-Secrets file and that they are logged in
> the wtmp upon login. I know that the 'last' command can show that wtmp
> file, and in my case, it does!!. I do 'last |grep ppp' and it shows
> the users and when they connected and disconnected to the vpn server.

I agree with Alan.  It is odd that it logs to wtmp but not utmp.

> The thing is, I thought the 'who' and the 'w' command also pull from
> the wtmp file, but I guess they dont??? perhaps they are pulling from
> the utmp file.
>
> if this is true, what is the difference between the utmp and the wtmp
> file.

The utmp file logs currently logged in users.  The file contains
records for each user.  If a user logs out then the entry is removed.

The wtmp file logs the history of who logged in and who logged out.
Instead of removing an entry it records that the user logged out.  All
things working okay then subtracting one from the other should yield
the same information as in the utmp file.  As long as a power failure
or system bug doesn't prevent accurate accounting then this will be
correct and in sync.  But not if a program logged a user in but then
crashes that user may not be recorded as having been logged out The
utmp database will still show the user logged in..  Later when the tty
is used again by another login from another user then that record in
the utmp file will be overwritten with the updated information and
corrected.  But until then it will be out of sync.

Looking at the man page for utmp will give you the details.

  man utmp

> And maybe you can speculate why pptpd/poptop is only logging in
> the wtmp to show in 'last' but not logging in utmp to NOT show in
> 'who' or 'w'. I could not find any settings to tweek and the only
> reference to any of the logs was in the file: "/etc/pptpd.conf" couple
> lines down where it specifies "logwtmp"

Not sure.  Verify that the utmp file is writable.  These files are
usually in different directories and may have different user and group
permissions.  On my system they are both root:utmp.

       /var/run/utmp
       /var/log/wtmp

If pptpd can't write to utmp but can write to wtmp then that would be
one explanation.

Bob

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.