1

I run w command on two machines. They both have exactly the same system installed: Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-87-generic x86_64). I am logged in as hans on both machines through SSH.

machine foo:

$ w
 13:18:20 up 26 days,  6:02,  1 user,  load average: 0.02, 0.03, 0.01
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
hans     pts/0    10.xxx.xxx.xxx   10:14    1.00s  0.08s  0.00s w

machine bar:

$ w
 13:11:17 up 46 days, 46 min,  1 user,  load average: 0.02, 0.04, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
hans     pts/0    10.xxx.xxx.xxx   10:14    0.00s  0.02s  0.02s sshd: hans [priv]

Why is the output different in column WHAT? On foo I see w and on bar: sshd: hans [priv]. Where does this asymmetry come from?

hans
  • 111
  • 3
  • You ran one as `hans` and one as `root` (the second one). – EightBitTony Dec 04 '17 at 12:50
  • When I log as root, on both I get [priv]. It behaves as I wrote when I am not logged in as root. The only difference is that on foo:`$ id` -> `uid=1001(hans)` and on bar: `$ id` -> `uid=1000(hans) ` – hans Dec 04 '17 at 12:55
  • Best include the output of `which w` and `alias w` for both machines. Also include `uname -a`, see what's providing `w` (it's often a symlink to `/usr/bin/w.procps`), and which version of the package you have installed (it should be the `procps` package I think) – EightBitTony Dec 04 '17 at 14:14
  • 1
    I can't chase this down all the way right now, but [procps-ng's w](https://gitlab.com/procps-ng/procps/blob/master/w.c#L318) captures a process listing then determines the "best" process to show in the `WHAT` column. During a quick test (looping `w`), I got a variety of hits: `w`, my shell, and a smattering of `sshd`. – Jeff Schaller Dec 04 '17 at 14:24
  • @EightBitTony `which w` gives on both machine `/usr/bin/w`, no alias for it, `uname -a` prints `Linux foo/bar 4.4.0-87-generic #110-Ubuntu SMP Tue Jul 18 12:55:35 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux` – hans Dec 04 '17 at 14:32
  • Anyway, @JeffSchaller comment seems a good answer to my question. Good to know that linux is not as deterministic as I would expect. – hans Dec 04 '17 at 14:34
  • 2
    in 100,000 runs, I got `w` 85% of the time, and `sshd` the other 15% of the time. Someone else can feel free to take this into an Answer before I do; my reading of the source leads me to think that `w` is simply not capturing itself ~15% of the time, and thus "falling" back to `sshd` as the "most recent" process to show for the `WHAT` field. – Jeff Schaller Dec 04 '17 at 14:49
  • To play along at home: `for((i=0;i<5000;i++)); do w | grep "$USER" | cut -c65-;done | sort | uniq -c |sort -rn` ## It's not exactly the loop I ran above, but a one-liner to simulate it. – Jeff Schaller Dec 04 '17 at 15:11

1 Answers1

0

The w command uses a heuristic to decide which process to show as the current process. The Linux man page doesn't explain how this works, but on my OS X system it says:

The notion of the "current process" is muddy. The current algorithm is "the highest numbered process on the terminal that is not ignoring interrupts, or, if there is none, the highest numbered process on the terminal". This fails, for example, in critical sections of programs like the shell and editor, or when faulty programs running in the background fork and fail to ignore interrupts. (In cases where no process can be found, w prints -.)

The failure modes described there could explain the inconsistent behavior you see.

Barmar
  • 9,648
  • 1
  • 19
  • 28