Miscount of users?

English Applications
1

ID=“opensuse-leap”
VERSION_ID=“15.5”
5.14.21-150500.55.39-default x86_64

Recent versoins of 15.5 cannot seem to correctly count the number of users using the command w. See below. Until the last 4-5 weeks, the count of users matched the list of users. Now it is typically counts 1 or 2 more than is listed.

Running who -a is oddly uninformative.

Anyone know what has changed with w that it can no longer count?

$  w
 10:46:33 up 7 days, 41 min,  7 users,  load average: 0.45, 0.27, 0.19
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
sma-user          :                13Jan24 ?xdm?  22:52m  0.05s gdm-session-worker [pam/gdm-password]
sma-user seat0    login-           13Jan24  0.00s  0.00s  0.00s /usr/lib/gdm/gdm-wayland-session /usr/bin/gnome-session
sma-user tty2     tty2             13Jan24  7days  0.06s  0.06s /usr/lib/gnome-session-binary
sma-user pts/1    fd2f:4760:521f:3 10:29   16:31   0.12s  0.12s -bash
sma-user pts/2    fd2f:4760:521f:3 10:46    0.00s  0.10s  0.01s w

 $ who -a
           system boot  2024-01-13 10:05
           run-level 5  2024-01-13 10:05
LOGIN      tty1         2024-01-13 10:05              3680 id=tty1
sma-user3x ? :            2024-01-13 10:06   ?          4729 (:)
sma-user3x ? seat0        2024-01-13 10:06   ?          5500 (login screen)
sma-user3x + tty2         2024-01-13 10:06  old         5500 (tty2)
sma-user3x + pts/1        2024-01-20 10:29 00:16       28192 (fd2f:4760:521f:3f3c::c0a8:4573)
sma-user3x + pts/2        2024-01-20 10:46   .         30163 (fd2f:4760:521f:3f3c::c0a8:4573)
2

The “w” command is just reporting entries in the “utmp” database.

From your output, it looks as if “gdm” has added three entries. And when you open a terminal (“konsole” or “gnome-terminal” or “xterm” or similar), that adds an entry.

3

For a long time (5 - 7 years) w would show the same count as was listed. You are saying that there are now other entries in the utmp database that w does/can not count? This actually had me worried for a spell because I thought someone had managed to illicitly login.

How do I inspect the utmp database?

4

No, I’m not suggesting that.

If there are more entries now than in the past, then some software is putting in more entries.

If you change from “gdm” to maybe “lightdm” you will probably see a change in the output of “w”.

5

Just for fun I ran uptime, then w.

 16:15:29  up 7 days  6:10, 13 users,  load average: 0.33, 0.28, 0.21
 16:15:29 up 7 days,  6:10, 15 users,  load average: 0.33, 0.28, 0.21
6

Trying that here (uptime followed by w):

 1% uptime
 17:34:48  up 2 days  2:57,  6 users,  load average: 0.06, 0.13, 0.29
 2% w
 17:34:50 up 2 days,  2:57,  1 user,  load average: 0.06, 0.13, 0.29

However, “w” does give 6 lines of information corresponding to the 6 users. It looks as if “w” is counting unique users in its count, while “uptime” is counting the total number of lines.

7

The purpose of displaying the output of w was to detect unauthorized users.
What would you suggest as an alternative?

8

“w” is not a good tool for that.

It’s possible for a user to have active processes, without anything appearing in the “w” output. For example

xterm -ut

will start a terminal session that is not recorded in the utmp database.

You could use “ps” and sort the output by the process user/owner.

9

Have a look at lastlog command

10

That will do. Thank you.