When managing CentOS 6 systems, you might encounter a frustrating situation where a user account can't be deleted because the system insists the user is still logged in - even after running pkill -KILL -u username. Let's explore why this happens and reliable solutions.

Linux maintains several types of user session tracking:

# Check all login sessions
who -u

# View process tree
pstree -u username

# Check wtmp entries
last username

Try this multi-step process to completely eliminate user sessions:

# 1. Kill all processes (more thorough than pkill)
ps -u username -o pid= | xargs -r kill -9

# 2. Remove cron jobs
crontab -r -u username

# 3. Clear process accounting
sa -u username

# 4. Remove at jobs
atq | grep username | awk '{print $1}' | xargs atrm

# 5. Terminate all file locks
lsof -u username | awk '{print $2}' | xargs kill -9

Examine these critical system files that might maintain session references:

# Check utmp (current logins)
cat /var/run/utmp

# Check wtmp (login history)
last -f /var/log/wtmp

# Check btmp (failed logins)
lastb -f /var/log/btmp

After completing all cleanup steps:

userdel -r username
groupdel username

Verify removal by checking these files:

grep username /etc/passwd /etc/shadow /etc/group

---

On CentOS 6 systems (and other Linux distributions), you might encounter this frustrating scenario when trying to delete a user:

# userdel username
userdel: user username is currently logged in

Even after running pkill -KILL -u username or similar commands, the system still refuses to remove the user. Let's explore why this happens and the proper solution.

The system maintains multiple references to user sessions including:

• SSH sessions
• Cron jobs
• Screen/tmux sessions
• Database connections
• NFS mounts

A simple pkill might not catch all these. The most reliable method is to check all process types and session files.

First, verify all processes belonging to the user:

# ps -fu username
# pgrep -u username

For thorough cleanup:

# pkill -9 -u username
# pkill -9 -t pts/  # kills all terminal sessions
# pkill -9 -t tty   # kills local console sessions

These locations might contain active session references:

# ls /var/run/utmp
# last username
# who -u

To clear session records:

# loginctl terminate-user username  # systemd systems
# rm -f /var/run/utmp

When everything else fails, use:

# userdel -f -r username

The -f forces removal even if the user is logged in, and -r removes the home directory and mail spool.

• Always check w or who before deleting users
• Consider maintenance windows for user removal
• For automated systems, implement pre-removal checks

If the user still can't be removed, manually clean these files:

/etc/passwd
/etc/shadow
/etc/group
/etc/gshadow
/home/username
/var/spool/mail/username

Then run:

# pwck
# grpck

This should completely eliminate all user traces from the system.