'finger' shows dead terminal shells

[Cobalt]

I've noticed lately that when I do "finger" on my system (10.1.3), sometimes there are more than two instances of my login. (There should always be at least two: one for my logging into OS X in general, and one for the open Terminal session). Here's an example:


[localhost:~] cobalt% date
Tue Mar 12 21:24:18 EST 2002
[localhost:~] cobalt% finger
Login Name Tty Idle Login Time Office Office Phone
cobalt Tom *co 21:28 Mar 12 00:06
cobalt Tom p1 Mar 12 00:07
cobalt Tom p2 30 Mar 12 21:21
cobalt Tom p3 9:31 Mar 12 11:52

I realized that the 'extra' instances of me must be old Terminal sessions. (Sometimes I open a second or third terminal window, then 'logout' of that window.) My Terminal preferences include "close window if shell exits cleanly." And the windows have always closed, so I've assumed everything was going well. When I do "ps aux | grep cobalt" it only lists one instance of -tcsh.

So my question is, why are these 'old' and supposed-to-be non-existent sessions showing up even though I've closed them?

Even weirder, why does a newly-opened window "fill in" those old shells? In other words, if I start with ttyp1 open, and then open a new Terminal window - which shows it is ttyp2 - and do 'finger' again, does the fact that the Idle time for Tty item p2 goes back to zero mean that the system is keeping a placeholder for every terminal window I open in case I close it and decide to open a new one again??

Tom :confused:

[mervTormel]

i see this too. it seems that lastlog has some bugs in it.

i opened four shell windows, exited two and get the following:

$ last | grep still
merv ttyp4 Tue Mar 12 20:37 still logged in
merv ttyp3 Tue Mar 12 20:37 still logged in
merv ttyp2 Mon Mar 11 18:14 still logged in
merv ttyp1 Mon Mar 11 16:42 still logged in

i think something fails to close the tty devices...

$ ll /dev/tty*
crw-rw-rw- 1 root wheel 43, 0 Mar 10 14:20 /dev/tty
crw--w---- 1 root tty 4, 0 Mar 10 14:20 /dev/ttyp0
crw--w---- 1 merv tty 4, 1 Mar 12 18:08 /dev/ttyp1
crw--w---- 1 merv tty 4, 2 Mar 12 21:00 /dev/ttyp2
crw--w---- 1 merv tty 4, 3 Mar 12 20:51 /dev/ttyp3
crw--w---- 1 merv tty 4, 4 Mar 12 20:51 /dev/ttyp4

but they don't appear in lsof

$ lsof | grep ttyp
loginwind 359 merv 10u VCHR 4,0 0t0 76458628 /dev/ttyp0
ssh-agent 378 merv 10u VCHR 4,0 0t0 76458628 /dev/ttyp0
...
tcsh 6078 merv 19u VCHR 4,1 0t5896 76458372 /dev/ttyp1
bash 6564 merv 0u VCHR 4,2 0t2048037 76458116 /dev/ttyp2
...

but the ttyp devices do seem to get recycled with new shell windows.

don't depend on finger and last for accurate data.

[elakin]

Terminal.app isn't updating the utmp database.
When a program allocates a pseudo-terminal (pty) for interactive command-line type stuff, it's
supposed to add an entry to the utmp database. This database can then be used by other programs
to easily see who's logged in - "who" and "w" also
use this. When the person logs out, closes the
terminal window, or otherwise frees up the pty, the utmp database is supposed to be updated - removing the entry so that the user no longer looks logged in. Terminal.app isn't doing this.

Other programs do behave properly, however:

isis% who
elakin console Mar 11 14:55
elakin ttyp1 Mar 11 14:56
elakin ttyp2 Mar 11 15:34
isis% ssh localhost
elakin@localhost's password:
Welcome to Darwin!
isis% who
elakin console Mar 11 14:55
elakin ttyp1 Mar 11 14:56
elakin ttyp2 Mar 11 15:34
elakin ttyp3 Mar 12 21:16 (localhost)
isis%
Connection to localhost closed.
isis% who
elakin console Mar 11 14:55
elakin ttyp1 Mar 11 14:56
elakin ttyp2 Mar 11 15:34

after closing a terminal window, the next program
to require a pty will recieve the lowest # available - probably from the just closed terminal. And when that new program registers itself in the utmp database with that pty, it'll
overwrite the old kruft that terminal.app forgot
to remove.

[mervTormel]

elakin, thanks for the excellent info. more flakiness accrued to the terminal app then?

[THEM]

It's pretty much not a cleanly exited terminal. To change this go the Prefrences:Shell:Use This Shell and type in the path to the shell you want to use. /bin/tcsh etc... You'll get all the benefits minus the motd.

[pmccann]

I'd love to be proven wrong, but I don't think this has anything to do with that terminal preference (and, for what it's worth, explicitly specifying the shell to use has at least one nasty side-effect that we discovered in another thread. Essentially, the ownership of the ttyp is not changed when you open extra windows with this setting, leaving root:wheel as user:group.)

If I recall correctly, the reason you see these ghost processes is related to the wacko way in which terminal runs, which in turn is related to the "unusual" way that macosx runs. Since this is a hit and run post I'll try to be brief: instead of a single "login" style window, from which you crank up a series of non-login xterms and the like, in macosx's terminal.app each window is a new login window. Unfortunately, while terminal.app runs a login process with each new window that writes the entry to the utmp log, it does not have the "oomph" to write to the log itself, and hence cannot add the corresponding "negative" entry to the file. (The log is only writeable by root, and terminal.app does not run setuid root.)

Apologies for the slightly hazy recollection.

All the best,
Paul