w & top show 2 users but only 1 user is logged in ... i hope!

[mowgliee]

i have 2 servers, web server & mail server. they show 2 users in the summary area when i run w or top commands. but the actual list of users logged in (using either w or who) shows only 1 user.

ps -ef |grep username only shows my current login as a running sshd process.

so i can find no trace of this other user except in the summary line for w or top. whats going on?!!

i have no shells or other logins left running elsewhere or abruptly terminated, no gui sessions (these are servers), no tty logins.

do i have another user logged in? has someone hacked me & covered up most of their trail? why do these commands show 2 users when everything else points to 1 user?

[plucky]

Every system shows two users.Your user and the /root user.If you log out then there is only the /root user.

do i have another user logged in?

The /root user

has someone hacked me & covered up most of their trail?

No

why do these commands show 2 users when everything else points to 1 user?

yourself and the /root user.

Good luck

[uRock]

This is normal.

rabbit@ronnie-desktop:~$ w
 12:00:23 up 2 days,  4:56,  2 users,  load average: 0.17, 0.07, 0.06
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
rabbit   tty7     :0               Tue07    2days  2:30m  1.76s gnome-session
rabbit   pts/0    :0.0             12:00    0.00s  0.46s  0.01s w
rabbit@ronnie-desktop:~$ who
rabbit   tty7         2011-03-15 07:04 (:0)
rabbit   pts/0        2011-03-17 12:00 (:0.0)

[mowgliee]

plucky, i also have a file/nfs server & it only shows 1 user, both in the summary area & in the list of users (w or who). & even the web & mail server showed 1 user in the past, which is why i find it strange they show 2 users now. why would i have a root user logged in at all times? that doesnt make sense.

also this is ubuntu; i dont log in as root. i'm not even sudo -s when i run the commands. i login as myself & run the commands. i dont su to root or run them as sudo. anyway the fact that i have other servers who only show 1 user refutes this explanation.

urock, the difference is when i run w or who, it says 2 users (like yours) but it only lists 1 user (unlike yours). so it is not normal or typical behaviour. if my output looked like yours, i wouldnt find it questionable at all.

i do agree its probably not been hacked or anything so dramatic. but why is it doing this? why is it saying 2 users but only listing 1? why does 1 server show 1 user, but the other 2 show 2 users when all 3 only have 1 user logged in?

there must be some way to force the system to list who these 2 users are?

[uRock]

Can you show us the output of these commands, so that we can see what you're looking at?

Moved to Security Discussions sub-forum.

[tgm4883]

An open terminal counts as a user.

Open up 5 terminals, then run the command. I bet you have 6 users listed

[mowgliee]

urock, sure thing

w results in:

 15:52:44 up 14 days,  3:49,  2 users,  load average: 0.03, 0.04, 0.00
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
user1      pts/0    xxx.xxx.xxx.xxx    12:03    0.00s  0.04s  0.03s sshd: user1 [priv]

top results in:

top - 15:54:15 up 1 day,  3:50,  2 users,  load average: 0.03, 0.04, 0.00

but on another server, w results in:

 15:55:55 up 3 days,  3:40,  1 user,  load average: 1.43, 1.50, 1.42
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
user1      pts/0    host.name      12:05    0.00s  1.21s  0.12s sshd: user1 [priv]

and for top:

top - 16:04:55 up 3 days,  3:49,  1 user,  load average: 1.25, 1.25, 1.33

so whats going on? the first server shows 2 users but only lists 1. the second server shows 1 user & lists 1 (as expected). so it cant be anything to do with root user or other explanations provided here; otherwise both servers would exhibit same results.