Dead linux users?

Not dead as in dead, but dead as in the user has logged out of the system and for some reason their shell is still open. This might happen if your system crashes before you can log out, there are network problems and you are disconnected, or a number of other reasons. This article explains how to log these “dead” shell users out.

I use the command “w” to find out who is logged in and how long they have been idle. Compare this to the “who” command:

# w
07:47:18 up 73 days, 9:15, 2 users, load average: 0.43, 0.17, 0.11
root pts/0 pool-ip-addr 07:44 0.00s 0.04s 0.00s w
root pts/2 pool-ip-addr 07:45 1:26 0.02s 0.02s -bash
# who
root pts/0 Sep 22 07:44 (
root pts/2 Sep 22 07:45 (

You can also see the command they are currently running, and the TTY they are on. In this case you can see I ran the “w” command, so you can tell that pts/0 is the current session – and pts/2 is the “other” connection. You get this information from the “who” command as well, but “w” adds the idle time (which you can get with who -i, actually). Anyway you can can use either one, it is just a matter of preference.

First find the process list:

# ps fax

10585 ? Ss 0:05 /usr/sbin/sshd
16984 ? Ss 0:00 \_ sshd: root@pts/0
16986 pts/0 Ss 0:00 | \_ -bash
17068 pts/0 R+ 0:00 | \_ ps fax
17033 ? Ss 0:00 \_ sshd: root@pts/2
17035 pts/2 Ss+ 0:00 \_ -bash

Look for the sshd line, this is the ssh server (hopefully you aren’t using telnet any more!)

You can see it shows the pts/0 login, and the pts/2 login.

Find the parent process number of the “other” shell that is logged in. In this particular case, the number is “17033”

Kill that process (Note: you must be the root user to do this, use “sudo” or the like if you are in Ubuntu):

# kill 17033
# kill -9 17033

Which will force the other idle shell to log out.

Check “w” again to make sure they are logged out.

Dave Drager

Dave Drager


Sign in or become a free systemBash member to read and leave comments.
Just enter your email below to get an easy log in link.