Dead linux users?



Not dead as in dead, but dead as in the user has logged out of the system and for some reason their shell is still open. This might happen if your system crashes before you can log out, there are network problems and you are disconnected, or a number of other reasons. This article explains how to log these “dead” shell users out.

I use the command “w” to find out who is logged in and how long they have been idle. Compare this to the “who” command:

1
2
3
4
5
6
7
8
9
# w
 07:47:18 up 73 days,  9:15,  2 users,  load average: 0.43, 0.17, 0.11
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    pool-ip-addr 07:44    0.00s  0.04s  0.00s w
root     pts/2    pool-ip-addr 07:45    1:26   0.02s  0.02s -bash
# who
root     pts/0        Sep 22 07:44 (pool-ip-addr.phlapa.fios.verizon.net)
root     pts/2        Sep 22 07:45 (pool-ip-addr.phlapa.fios.verizon.net)
#

You can also see the command they are currently running, and the TTY they are on. In this case you can see I ran the “w” command, so you can tell that pts/0 is the current session – and pts/2 is the “other” connection. You get this information from the “who” command as well, but “w” adds the idle time (which you can get with who -i, actually). Anyway you can can use either one, it is just a matter of preference.

First find the process list:

1
2
3
4
5
6
7
8
9
# ps fax
<a whole lot of other stuff cut out>
10585 ?        Ss     0:05 /usr/sbin/sshd
16984 ?        Ss     0:00  \_ sshd: root@pts/0
16986 pts/0    Ss     0:00  |   \_ -bash
17068 pts/0    R+     0:00  |       \_ ps fax
17033 ?        Ss     0:00  \_ sshd: root@pts/2
17035 pts/2    Ss+    0:00      \_ -bash
<a whole lot of other stuff cut out>

Look for the sshd line, this is the ssh server (hopefully you aren’t using telnet any more!)

You can see it shows the pts/0 login, and the pts/2 login.

Find the parent process number of the “other” shell that is logged in. In this particular case, the number is “17033”

Kill that process (Note: you must be the root user to do this, use “sudo” or the like if you are in Ubuntu):

1
2
3
# kill 17033
or
# kill -9 17033

Which will force the other idle shell to log out.

Check “w” again to make sure they are logged out.

  • Thomas

    Thank you for this tutorial! I have been looking for this for I do not know how log! Every time my session end without a proper logout/exit, I ended up with multiple live sessions and just waited until they timed out to get rid of them, unless of course I did a reboot. Again Thank you! Thomas

  • Thomas

    Thank you for this tutorial! I have been looking for this for I do not know how log! Every time my session end without a proper logout/exit, I ended up with multiple live sessions and just waited until they timed out to get rid of them, unless of course I did a reboot. Again Thank you! Thomas