Re: Should I be concerned that w/who reported 0 users?

[Patrick Wiseman <pwiseman@gmail.com>]

On Tue, Jan 14, 2014 at 4:48 PM, Bob Proulx <bob@proulx.com> wrote:
> Patrick Wiseman wrote:
>> I manage a virtual machine remotely, running Debian stable. Recently,
>> both 'w' and 'who' were reporting zero users. The machine had been up
>> for 141 days, so I did 'sudo shutdown -r now' and returned to it a few
>> minutes later, when 'w' and 'who' reported appropriately. Is this any
>> cause for concern?
>
> I would suspect a system problem more than a break-in.  The w and who
> commands simply dump the contents of the /var/run/utmp file.
>
> Does that file exist for you and does it have the correct permissions?
> Here is an example from my system.
>
>   $ ls -l /var/run/utmp
>   -rw-rw-r-- 1 root utmp 24960 Jan 14 14:32 /var/run/utmp
>
> That file is created at boot time by /etc/init.d/bootmisc.sh linked to
> the /etc/rcS.d/S??bootmisc.sh symlink in the tmpfs partitions.  It is
> tmpfs and always starts empty at boot time.  If that file does not
> exist then check that the symlink for it is installed.  If it is not
> installed then check all of the init links as others may be missing
> too.
>
>   $ ls -l /etc/rcS.d/S??bootmisc.sh

Thanks. After I rebooted, the information is back so I'm guessing its
absence was caused by my having updated a few times without rebooting.
All seems to be functioning properly.

Patrick