# WHO shows older logins as well as current



## Flantec (May 27, 2014)

I am currently logged in as James (and `su` to root), but `who` shows 2 other sessions that were previously logged in on pts/0.  What's more is that when I do a `whoami`, it does not even come back with the correct result.


```
[root@filepro james]# who
wcmms            pts/0    May 26 17:44 (wcmms)
james            pts/0    May 26 21:56 (10.8.27.1)
haymmw1          pts/0    May 26 17:59 (10.128.0.20)
[root@filepro james]# who am i
wcmms            pts/0    May 26 17:44 (wcmms)
```

Some searching has hinted at possible orphaned process from the previous session, but I cannot locate any process that would reflect that either haymmw1 or wcmms being seen as logged in.  Below is the output of `ps auxw`.


```
USER   PID  %CPU %MEM   VSZ   RSS TT  STAT STARTED       TIME COMMAND
root    11 699.6  0.0     0    64 ??  RL    2:42PM 3340:36.89 [idle]
root  2615 100.0  1.3 51816 42984 ??  R    10:00PM    8:38.87 /usr/local/bin/php /root/wccsync/zensync.php
root     0   0.0  0.0     0    80 ??  DLs   2:42PM    0:21.33 [kernel]
root     1   0.0  0.0  8036   360 ??  ILs   2:42PM    0:00.01 /sbin/init --
root     2   0.0  0.0     0     8 ??  DL    2:42PM    0:00.00 [mpt_recovery0]
root     3   0.0  0.0     0     8 ??  DL    2:42PM    0:00.00 [mpt_raid0]
root     4   0.0  0.0     0     8 ??  DL    2:42PM    0:00.00 [sctp_iterator]
root     5   0.0  0.0     0     8 ??  DL    2:42PM    0:00.00 [xpt_thrd]
root     6   0.0  0.0     0     8 ??  DL    2:42PM    0:01.15 [pagedaemon]
root     7   0.0  0.0     0     8 ??  DL    2:42PM    0:00.00 [vmdaemon]
root     8   0.0  0.0     0     8 ??  DL    2:42PM    0:00.00 [pagezero]
root     9   0.0  0.0     0     8 ??  DL    2:42PM    0:00.10 [bufdaemon]
root    10   0.0  0.0     0     8 ??  DL    2:42PM    0:00.00 [audit]
root    12   0.0  0.0     0   200 ??  WL    2:42PM    0:33.40 [intr]
root    13   0.0  0.0     0    24 ??  DL    2:42PM    0:04.41 [geom]
root    14   0.0  0.0     0     8 ??  DL    2:42PM    0:18.08 [yarrow]
root    15   0.0  0.0     0   160 ??  DL    2:42PM    0:00.34 [usb]
root    16   0.0  0.0     0     8 ??  DL    2:42PM    0:00.41 [vnlru]
root    17   0.0  0.0     0     8 ??  DL    2:42PM    0:06.49 [syncer]
root    18   0.0  0.0     0     8 ??  DL    2:42PM    0:00.20 [softdepflush]
root   129   0.0  0.0  9456  1096 ??  Is    2:42PM    0:00.00 adjkerntz -i
root   788   0.0  0.1 12132  2904 ??  Is    2:42PM    0:00.01 /sbin/devd
root   919   0.0  0.0  9544  1296 ??  Ss    2:42PM    0:00.04 /usr/sbin/syslogd -s
root   930   0.0  0.0  9572  1392 ??  Is    2:42PM    0:00.02 /usr/sbin/rpcbind
root   979   0.0  0.0  9548  1400 ??  Is    2:42PM    0:00.00 /usr/sbin/mountd -n
root   981   0.0  0.0  9456  1336 ??  Is    2:42PM    0:00.03 nfsd: master (nfsd)
root   983   0.0  0.0  9456  1144 ??  S     2:42PM    0:00.10 nfsd: server (nfsd)
root  1006   0.0  0.1 14308  3228 ??  Ss    2:42PM    0:00.18 /usr/local/sbin/nmbd -D -s /usr/local/etc/smb.conf
root  1009   0.0  0.1 24784  5008 ??  Is    2:42PM    0:00.05 /usr/local/sbin/smbd -D -s /usr/local/etc/smb.conf
root  1020   0.0  0.0  9452  1268 ??  Is    2:42PM    0:00.00 /usr/sbin/lpd
root  1043   0.0  0.1 11256  2256 ??  Ss    2:42PM    0:00.53 /usr/sbin/ntpd -c /etc/ntp.conf -p /var/run/ntpd.pid -f /var/db/ntpd.
root  1059   0.0  0.2 25308  5100 ??  I     2:42PM    0:00.05 /usr/local/sbin/smbd -D -s /usr/local/etc/smb.conf
root  1062   0.0  0.1 13096  2412 ??  Is    2:42PM    0:00.00 /usr/sbin/sshd
root  1067   0.0  0.4 86764 14356 ??  Ss    2:42PM    0:00.53 /usr/local/sbin/httpd -DNOHTTPACCEPT
root  1075   0.0  0.1 11296  2740 ??  Ss    2:42PM    0:00.23 sendmail: accepting connections (sendmail)
smmsp 1078   0.0  0.1 11296  2640 ??  Is    2:42PM    0:00.01 sendmail: Queue runner@00:30:00 for /var/spool/clientmqueue (sendmail
root  1083   0.0  0.0  9584  1328 ??  Ss    2:42PM    0:00.05 /usr/sbin/cron -s
root  1103   0.0  0.0  9608  1412 ??  Is    2:42PM    0:00.00 /usr/sbin/inetd -wW -C 60
root  1141   0.0  0.2 25084  5324 ??  S     2:42PM    0:00.05 /usr/local/sbin/smbd -D -s /usr/local/etc/smb.conf
www   1143   0.0  0.4 90860 14468 ??  S     2:42PM    0:01.33 /usr/local/sbin/httpd -DNOHTTPACCEPT
www   1144   0.0  0.4 90860 14468 ??  S     2:42PM    0:01.29 /usr/local/sbin/httpd -DNOHTTPACCEPT
root  1146   0.0  0.2 25116  5556 ??  S     2:42PM    0:00.07 /usr/local/sbin/smbd -D -s /usr/local/etc/smb.conf
www   1165   0.0  0.4 90860 14468 ??  I     2:42PM    0:01.32 /usr/local/sbin/httpd -DNOHTTPACCEPT
www   1621   0.0  0.4 90860 14468 ??  I     5:11PM    0:00.90 /usr/local/sbin/httpd -DNOHTTPACCEPT
www   1740   0.0  0.4 90860 14464 ??  I     5:34PM    0:00.83 /usr/local/sbin/httpd -DNOHTTPACCEPT
www   1742   0.0  0.4 90860 14468 ??  I     5:34PM    0:00.86 /usr/local/sbin/httpd -DNOHTTPACCEPT
root  1747   0.0  0.2 25144  5772 ??  I     5:37PM    0:00.07 /usr/local/sbin/smbd -D -s /usr/local/etc/smb.conf
root  1751   0.0  0.2 25144  5764 ??  I     5:40PM    0:00.06 /usr/local/sbin/smbd -D -s /usr/local/etc/smb.conf
www   1757   0.0  0.4 90860 14468 ??  I     5:42PM    0:00.85 /usr/local/sbin/httpd -DNOHTTPACCEPT
root  1808   0.0  0.2 25144  5752 ??  I     5:48PM    0:00.09 /usr/local/sbin/smbd -D -s /usr/local/etc/smb.conf
www   1951   0.0  0.4 90860 14468 ??  I     6:20PM    0:00.68 /usr/local/sbin/httpd -DNOHTTPACCEPT
www   1968   0.0  0.4 90860 14464 ??  I     6:26PM    0:00.74 /usr/local/sbin/httpd -DNOHTTPACCEPT
www   1969   0.0  0.4 90860 14468 ??  S     6:26PM    0:00.75 /usr/local/sbin/httpd -DNOHTTPACCEPT
www   1997   0.0  0.4 90860 14464 ??  S     6:34PM    0:00.67 /usr/local/sbin/httpd -DNOHTTPACCEPT
www   2035   0.0  0.4 90860 14464 ??  S     6:47PM    0:00.62 /usr/local/sbin/httpd -DNOHTTPACCEPT
www   2058   0.0  0.4 90860 14464 ??  S     6:59PM    0:00.62 /usr/local/sbin/httpd -DNOHTTPACCEPT
root  2587   0.0  0.1 12584  3112 ??  Ss    9:56PM    0:00.01 telnetd
root  2610   0.0  0.0  9584  1428 ??  I    10:00PM    0:00.00 cron: running job (cron)
root  2614   0.0  0.0  9852  1564 ??  Is   10:00PM    0:00.00 /bin/sh /flantec/scripts/zenfolio_sync
smmsp 2622   0.0  0.1 11296  3296 ??  Is   10:00PM    0:00.01 /usr/sbin/sendmail -FCronDaemon -odi -oem -oi -t
root  1123   0.0  0.0  9544  1208 v0  Is+   2:42PM    0:00.00 /usr/libexec/getty Pc ttyv0
root  1124   0.0  0.0  9544  1208 v1  Is+   2:42PM    0:00.00 /usr/libexec/getty Pc ttyv1
root  1125   0.0  0.0  9544  1208 v2  Is+   2:42PM    0:00.00 /usr/libexec/getty Pc ttyv2
root  1126   0.0  0.0  9544  1208 v3  Is+   2:42PM    0:00.00 /usr/libexec/getty Pc ttyv3
root  1127   0.0  0.0  9544  1208 v4  Is+   2:42PM    0:00.00 /usr/libexec/getty Pc ttyv4
root  1128   0.0  0.0  9544  1208 v5  Is+   2:42PM    0:00.00 /usr/libexec/getty Pc ttyv5
root  1129   0.0  0.0  9544  1208 v6  Is+   2:42PM    0:00.00 /usr/libexec/getty Pc ttyv6
root  1130   0.0  0.0  9544  1212 v7  Is+   2:42PM    0:00.00 /usr/libexec/getty Pc ttyv7
root  2588   0.0  0.1 10092  1824  0  Is    9:56PM    0:00.03 login [pam] (login)
james 2589   0.0  0.1 10760  2388  0  I     9:56PM    0:00.01 -bash (bash)
root  2592   0.0  0.1 10088  1816  0  I     9:56PM    0:00.03 su
root  2593   0.0  0.1 10760  2392  0  S     9:56PM    0:00.01 su (bash)
root  2637   0.0  0.0  9600  1372  0  R+   10:10PM    0:00.00 ps auxw
```

Thank you very much in advance.


----------



## Flantec (May 28, 2014)

I forgot to mention that I am using 9.2-RELEASE-p6 FreeBSD.  I am hopeful that someone has a solution to fix this.  When many users are logged in, it is much more difficult to determine who is logged in where, and which sessions are actually active.  *T*hanks again.


----------

