[CLUE-Tech] who command, what is says

[David Anselmi]

Kevin Cullis wrote:
> David,
> 
> The below "listing" was just an example, not the actual stuff.  The ???
> DOES have his name show up and there are different login times for each.

IIRC, who and w read out of the utmp file which records logins and 
logouts.  I'm not sure of the details, but I think it is possible for 
utmp entries to be left around after a user is gone giving you 
inaccurate output.  Just another possibility.

Well, ok, utmp(5) says that init handles these entries so I guess you'd 
have to have a system crash and not clean up utmp on reboot to get it 
out of whack.  Oh well.

BTW, if something were left running to spy on you, it probably wouldn't 
have a utmp entry.  Take a look at the utmp man page, kind of cool.

Dave