How do you define "logged in"?

[guy at gorodish.UUCP]

>	Can somebody give me a good definition of "being logged in"?

The problem is less one of a good definition of "being logged in"
than one of which programs should report login sessions and which
should report multiple windows belonging to the same session.

>	On a Sun workstation, if you run w, it shows you being logged in
>multiple times, once for each window (just the windows running shells, I
>think).

I consider this not to be unreasonable behavior; you could, for
example, have two jobs running in two different windows, and "w"
should report the activity of both jobs.  Also, if "w" just reported
login sessions, the idle time it reports would be that of
"/dev/console", which is often not very meaningful (when inside the
window system, "/dev/console" is usually idle).

Of course, one problem with this is that if you have a window with no
associated pseudo-tty (say an EMACS window with no shell window), it
doesn't show up.

>W also has a tendency not to realize when you log out -- I think
>as long as a pty doesn't get reused, w still thinks you are logged in
>there.

"w" prints a line for every seemingly-active line in the "utmp" file.
SunView should be clearing lines out whenever a window is closed;
if it's not, there's some sort of problem.

>On the other hand, w on the Sun correctly shows people who are
>logged in via network connections (rlogin or telnet), while the Vax seems
>to ignore those.  Running who or last on the Vax also misses the network
>logins, but lastcomm records commands run on network login connections and
>when you login, the "Last login:" message does take into account network
>connections.

This sounds like either a bug or a setup problem on the VAX side.
Did you put an entry for each pseudo-terminal into "/etc/ttys"?  If
not, that could explain it.  "login" has to know where to put the
"utmp" entry; it does this by calling "ttyslot" which looks the
current terminal up in "/etc/ttys".  If it doesn't find it, "login"
just doesn't bother recording the session in "/etc/utmp" or
"/usr/adm/wtmp", which would explain why the session doesn't show up
with "who" or "last".

"lastcomm" records every single command run on the system, if you
turn accounting on; when a process exits, the kernel writes a record
to the accounting file.  This is independent of the terminal from
which the command is run; it even works if the command isn't run from
a terminal.

"login" will record the login time in "/usr/adm/lastlog" even if it
doesn't find the entry in "/etc/ttys", which is why the "Last login"
time is updated.

>	Moving on to rwho, we see that the Sun file servers properly report
>the number of people who are logged in (either on the console or via the
>network), while the Vax only reports serial line logins, missing the
>network connections,

Which could also be explained by an incomplete "/etc/ttys" on the
VAX; "rwho" just reads the "utmp" file and broadcasts its findings.

>	I would consider the 1-5 to be logged in, and 7-12 not.  6 is a bit
>hazy, but I think I would put it in the first category.

I tend to agree, except in the case of "w", where I'd argue it should
print something for each window.

On a Sun, "sessions" in categories 1-5 and 7 get entries in
"/etc/utmp", and none of the others do.  There is a macro in <utmp.h>
called "nonuser" which distinguishes category 7 from categories 1-5;
it assumes that any pseudo-tty that has a session listed for it in
"/etc/utmp" is either being used for a tty subwindow or a network
login, and therefore that if there's no host name it must be a tty
subwindow.

I'm considering modifying "who" and "finger" to use "nonuser" (note:
the "rusers" RPC service, which the "rusers" command uses, also uses
"nonuser", so if you do "rusers <host>" it won't report tty windows).
"finger"'s behavior is just stupid now; it tells you more-or-less the
same information N times.