Hi,
if there is no /run/utmp file, /usr/bin/who falls back correctly to the systemd-logind interface and shows correct data. But there are applications, which don't use the libc interface for reading/writing utmp entries, they have their own implementation. And this implementations create the file /run/utmp if this does not exist (glibc does not). Which means, /usr/bin/who shows sometimes wrong/incomplete data. procps (especially w) and other packages don't check if /run/utmp exist or not, but use sd_booted(). e.g.: if (sd_booted() > 0) { numuser = sd_get_sessions(NULL); } else { setutent(); while ((ut = getutent())) { if ((ut->ut_type == USER_PROCESS) && (ut->ut_name[0] != '\0')) numuser++; } endutent(); } So if logind is running, logind is used, else /run/utmp. I think gnulib/coreutils should do the same. It's impossible to find and fix all the code writing utmp entries at their own, especially if this is 3rd party software and you don't have the source code. Thorsten -- Thorsten Kukuk, Distinguished Engineer, Senior Architect, Future Technologies SUSE Software Solutions Germany GmbH, Frankenstraße 146, 90461 Nuernberg, Germany Managing Director: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg)