I suppose it's a little late now, as I just decided to reboot to clear it up. I hate rebooting though, so I need to know for a future occurance...

I had an instance of root logged in, as shown from the 'who' command, that I could not account for and didn't know why it was there (had been for over a month according to the command). I read every man page I could think of, but I can't seem to determine a way to logout a logged in user, assumable by using their pts/* number or something of the sort. I was trying to break my record uptime, but this instance of root finally drove me nuts, hence the reboot.

I'm sure there's a way, if somebody could just kindly point me in the right direction...


TIA,

Jeff

Was there an associated shell running for the user?

I've no idea. The only commands I knew to get any info on the instance were users and who. I tried looking at /var/log/wtmp and /var/run/utmp (or vice versa....don't remember) but they're binaries and didn't give me much.

How would I have found that info? What other commands could I have used?

Thanks,

If you run "who -u" the last column will give you a PID for the login shell. If you want to see what is running in that shell then you can get a process tree with:
ps -efH

To log the user out just kill the pid:
kill <pid>

If it is hanging try:
kill -9 <pid>

Ah, thank you. That's exactly what I needed. Kinda depressing to know it was that simple, but I figured that would be the case...

Thanks again...