Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!uwm.edu!uwvax!uwslh!jiml
From: jiml@uwslh.slh.wisc.edu (James E. Leinweber)
Newsgroups: comp.unix.admin
Subject: Re: Program to log off idle users
Message-ID: <1990Oct10.170343.6664@uwslh.slh.wisc.edu>
Date: 10 Oct 90 17:03:43 GMT
References: <10504@hacgate.UUCP> <9800001@hpbbi4.BBN.HP.COM> <1990Oct4.135333.19139@warwick.ac.uk> <94@dlss2.UUCP>
Organization: Wisconsin State Laboratory of Hygiene
Lines: 21

james@dlss2.UUCP (James Cummings) writes:
>I wrote, and haven't finished smoothing out some
>of the edges on, a C implementation that looks directly at the utmp file
>for struct utmp.ut_type equal to "7"(a USER_PROCESS) and guages time by
>calling stat() against the utmp.ut_line (tty line) for last modified time.

Utmp and the actual terminal line aren't always a good judge of
idleness.  We run the "assassin" program (BSD systems only, posted a
few years ago) here, and we had to tell it to ignore kermit.  Our
version of kermit opens /dev/tty for its I/O, and a furiously active
transfer of a large file looks quite idle by any easy measure except
CPU activity.  I have grave doubts that there is any general way of
distinguishing idle users from unusual ones, at least in environments 
with distributed computations containing delays.  A typical thing here is
to start a kermit session between two minicomputers, with the local end idle
while the remote end generates the file to be transfered, followed by
the transfer.  If anyone can tell me how to tell that from an idle user, I'd
be amazed.
-- 
Jim Leinweber  (608)262-0736   State Lab. of Hygiene/U. of Wisconsin - Madison 
jiml@sente.slh.wisc.edu	       uunet!uwvax!uwslh!jiml        fax:(608)262-3257