w(5) shows non-existent or lost process?

[Frank Shute]

On Tue, Feb 17, 2009 at 02:54:47PM +0000, Anton Shterenlikht wrote:
>
> On Tue, Feb 17, 2009 at 08:02:12AM -0600, Randy Belk wrote:
> > On Tue, Feb 17, 2009 at 7:43 AM, Anton Shterenlikht <mexas at bristol.ac.uk> wrote:
> > > The who (or w, or finger) command shows that I'm still logged into ttyp5,
> > > even though I have rebooted the <xxx> box many times since. Does this mean
> > > the corresponding entry in /var/run/utmp is wrong and shouldn't be there, or is there
> > > still some process attached to ttyp5?
> > >
> > > ouput of w:
> > >
> > > USER             TTY      FROM      LOGIN@  IDLE WHAT
> > > mexas            p4       <xxx>     1:32pm     - w
> > > mexas            p5       <xxx>:0. 26Jan09 21days -
> > >
> > > ps ax | grep ttyp5
> > >  shows no process
> > >
> > > Looking at w(1) man page it seems that "-" in WHAT can be an indication
> > > that the process failed but not cleanly and that there could be some forked
> > > sub-process still alive. Does this make sense? Which other commands I can use
> > > to see what's going on?
> > >
> > 
> > LSOF is your friend! The port is located in /usr/ports/sysutils/lsof
> > To find out what is using ttyp5 type in "lsof | grep ttyp5" and it
> > should show you the process
> 
> # lsof |grep ttyp5
> #
> 
> this is 6.4-stable alpha which might not be fully supported by lsof,
> according to the man page. Anything else I can try?

I'm not sure why everybody recommends lsof for these sorts of problems
when fstat(1) does pretty much the same thing!

Glad you got your problem sorted anyway.

> 
> many thanks
> anton
> 

Regards,

-- 

 Frank 


 Contact info: http://www.shute.org.uk/misc/contact.html