Home / server / Questions / 461372
In Process
lorenzog
Asked: 2012-12-29 01:12:21 +0800 CST

Why do I have more users logged on than there are?

  • 772

On an old GNU/Linux Ubuntu box I see something like

lorenzo@metropolis:~
    $ w
 09:58:18 up 651 days, 19:30,  5 users,  load average: 0.28, 0.30, 0.24

The problem is, I am logged on other three sessions. The number should be four, not five. Any clue why the number of reported users is higher?

Checking lastlog, however, returns a correct value:

lorenzo@metropolis:~
    $ sudo last -ain 7 | grep 'still logged in' | wc -l
4

[edited] Here is the output of who, taken in another occasion but still showing two users, and three reported by w

lorenzo@metropolis:~
    $ who 
lorenzo  pts/0        Dec 28 13:10 (XXX)
lorenzo  pts/1        Dec 28 13:07 (XXX)
lorenzo@metropolis:~
    $ w
 13:11:15 up 651 days, 22:43,  3 users,  load average: 0.49, 0.40, 0.31
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
lorenzo  pts/0    XXX              13:10    0.00s  0.11s  0.00s w
lorenzo  pts/1    XXX              13:07    3:09m  0.13s  0.13s -bash

My paranoid sense is tingling.

[edited] some more commands requested

    $ cat /etc/issue
Ubuntu 8.04 \n \l

    $ dpkg-query -S /usr/bin/w.procps 
procps: /usr/bin/w.procps

    $ dpkg-query -S /usr/bin/who
coreutils: /usr/bin/who
linux

3 Answers

  1. w uses /var/run/utmp and the /proc filesystem (on Linux), recording who is currently logged on.

    last uses /var/log/wtmp (and /var/log/btmp), showing how has been logging in. However, not every program will update those files properly, on some systems these files may not even exist.

    For example, on my system w sees my 5 login-sessions within a single GNU screen session:

    $ w | tail -n +3 | wc -l
5

$ last | grep -c still\ logged
1

    Yet last only recorded one active session. When setting deflogin=off in GNU screen, even w loses track of the active login sessions and keeps displaying 5 sessions, even though I've just opened another 5 windows in that same screen session.

    IOW: use e.g. ps to find out how many users are "online", how many shells are open, etc. It will give more accurate results as does not rely on (stale) statfiles like /var/log/utmp.

    • 1

  2. In my case, w returns the Xsession in plus the open terminals

    $ w
 12:05:40 up  3:47,  2 users,  load average: 0.02, 0.15, 0.16
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
userXX   tty7     :0               08:18    3:47m 13:41   0.00s /bin/sh /etc/xdg/xfce4/xinitrc -- /etc/X11/xinit/xserverrc
userXX   pts/0    :0.0             12:03    0.00s  0.11s  0.00s w

    It is why there is one user more. Do you have the same thing ? Could you give use the complete w result, if it is not the case ?

    • 0

  3. when using just 'w' it will display the header plus the command that you are currently launching, so it will always show an additional line where your user appears executing 'w', then it will always show one more line.

    • 0