On Tue, Jan 14, 2014 at 4:48 PM, Bob Proulx <b...@proulx.com> wrote: > Patrick Wiseman wrote: >> I manage a virtual machine remotely, running Debian stable. Recently, >> both 'w' and 'who' were reporting zero users. The machine had been up >> for 141 days, so I did 'sudo shutdown -r now' and returned to it a few >> minutes later, when 'w' and 'who' reported appropriately. Is this any >> cause for concern? > > I would suspect a system problem more than a break-in. The w and who > commands simply dump the contents of the /var/run/utmp file. > > Does that file exist for you and does it have the correct permissions? > Here is an example from my system. > > $ ls -l /var/run/utmp > -rw-rw-r-- 1 root utmp 24960 Jan 14 14:32 /var/run/utmp > > That file is created at boot time by /etc/init.d/bootmisc.sh linked to > the /etc/rcS.d/S??bootmisc.sh symlink in the tmpfs partitions. It is > tmpfs and always starts empty at boot time. If that file does not > exist then check that the symlink for it is installed. If it is not > installed then check all of the init links as others may be missing > too. > > $ ls -l /etc/rcS.d/S??bootmisc.sh
Thanks. After I rebooted, the information is back so I'm guessing its absence was caused by my having updated a few times without rebooting. All seems to be functioning properly. Patrick -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/cajvvksnzakwwkzjjpdp4inxns9j+by6nyemuctscuu9pwzk...@mail.gmail.com
