Hi Bruno, Thank you for looking into this. I should clarify the relationship between the observations.
The monitoring alert is based on Zabbix's system.users.num item, which in this setup obtains the user count from `who | wc -l`. Therefore, changing what `who` reports would directly affect this particular alert. It is not a notification generated by systemd. I am also not suggesting that merely retaining the session in `loginctl` is necessarily a bug. A detached Screen process was still running in its scope, and the session remained in the "closing" state. The unexpected behavior is that, while this session remained unchanged in loginctl: - `who` did not list it when its former leader PID did not exist. - When an unrelated Apache worker running as www-data acquired that PID, `who` started listing the old SSH session, with its original login time and remote address. - When that Apache worker exited, the entry disappeared from `who` again. In other words, the presence of an unrelated process changed whether `who` considered the old session to represent a logged-in user. This appears consistent with readutmp using the recorded leader PID and checking its existence with kill(pid, 0), without distinguishing the original leader from a process that subsequently reused its PID. I agree that it is worth asking the systemd maintainers about the expected semantics of Leader for a closing session. I am happy to raise that question there. My proposed patch is an RFC, and I am not committed to filtering closing sessions if a different approach would be more appropriate. Would you nevertheless agree that the PID-reuse-dependent behavior in `who` is undesirable, regardless of whether retaining the closing session in loginctl is expected? Best regards, Przemek -----Original Message----- From: Bruno Haible <[email protected]> Sent: Sunday, October 4, 2026 2:59 PM To: [email protected]; Przemyslaw Zygmunt <[email protected]> Subject: Re: [PATCH RFC] readutmp: skip closing systemd sessions when checking PIDs Hi Przemyslaw, > loginctl still listed session 151944 with the same Leader. ... > This produced a false logged-in-user alert in monitoring. So, you have observed three ill effects: - 'who' (from coreutils) displays an session that is in "closing" state, - 'loginctl' (from systemd) still lists a session, - a logged-in-user alert. Patching the 'who' program will have no effect on what 'loginctl' displays and on notifications/alerts. Therefore IMO you should report the issue to the systemd people, and come back here, to decide what to do about the 'who' program, once they have decided about a resolution of the issue. Thanks. Bruno
