w(5) shows non-existent or lost process?

[Anton Shterenlikht]

On Tue, Feb 17, 2009 at 08:02:12AM -0600, Randy Belk wrote:
> On Tue, Feb 17, 2009 at 7:43 AM, Anton Shterenlikht <mexas at bristol.ac.uk> wrote:
> > The who (or w, or finger) command shows that I'm still logged into ttyp5,
> > even though I have rebooted the <xxx> box many times since. Does this mean
> > the corresponding entry in /var/run/utmp is wrong and shouldn't be there, or is there
> > still some process attached to ttyp5?
> >
> > ouput of w:
> >
> > USER             TTY      FROM      LOGIN@  IDLE WHAT
> > mexas            p4       <xxx>     1:32pm     - w
> > mexas            p5       <xxx>:0. 26Jan09 21days -
> >
> > ps ax | grep ttyp5
> >  shows no process
> >
> > Looking at w(1) man page it seems that "-" in WHAT can be an indication
> > that the process failed but not cleanly and that there could be some forked
> > sub-process still alive. Does this make sense? Which other commands I can use
> > to see what's going on?
> >
> 
> LSOF is your friend! The port is located in /usr/ports/sysutils/lsof
> To find out what is using ttyp5 type in "lsof | grep ttyp5" and it
> should show you the process

# lsof |grep ttyp5
#

this is 6.4-stable alpha which might not be fully supported by lsof,
according to the man page. Anything else I can try?

many thanks
anton

-- 
Anton Shterenlikht
Room 2.6, Queen's Building
Mech Eng Dept
Bristol University
University Walk, Bristol BS8 1TR, UK
Tel: +44 (0)117 928 8233 
Fax: +44 (0)117 929 4423