Who shows (unknown) user logged-in: what’s going on

userswwho

In a RHEL 7.3 server, I was trying to find logged-in users. I ran w and it told me there were two users, but it only showed me the info of one (myself); then I ran who, which displayed the other user as (unknown). Finally, I ran lastlog, with which's output I could match the log in date and port from who's output and find the unknown user actually is gdm.

$ w
 09:33:36 up 4 days, 15:22,  2 users,  load average: 0.00, 0.01, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
myusr     pts/0    172.16.23.113    09:32    0.00s  0.06s  0.03s w

$ who
(unknown) :0           2017-07-01 18:13 (:0)
myusr     pts/0        2017-07-06 09:32 (172.16.23.113)

$ lastlog 
Username         Port     From             Latest
...
gdm              :0                        Sat Jul  1 18:13:23 -0500 2017
...

The server is a supermicro machine and from time to time I connect to it using IPMI2's kvm over lan feature. But I don't remember anything weird happening when connecting like that.

This doesn't seem normal. What could have happened?

Best Answer

After reading Centimane's comment on /var/run/utmp and searching differently, I found this fedora forum thread, which mentioned the issue is provoked by a bug in GDM, which creates a bad entry in /var/run/utmp. Eventually I even found a bug report for it and another here.

Related Question