Operating System - HP-UX
1748287 Members
3200 Online
108761 Solutions
New Discussion

Re: decode contents of wtmp file

 
SOLVED
Go to solution
Dennis Handly
Acclaimed Contributor

Re: decode contents of wtmp file

>Would it be possible to change your script to give that kind of output?

 

Of course.  The script documents what it does.  If you want more than 20 records, just change the "20".

DBurton30
Established Member

Re: decode contents of wtmp file

With this being my first attempt to answer a question since the big change (old forums style to new), I hope this makes some sense, is readable, etc.

 

In the favorite sys admin scripts area:

 

http://h30499.www3.hp.com/t5/System-Administration/favorite-sysadmin-scripts-you-always-keep-around-2/m-p/4846799#M394272

 

A pretty smart guy named Kevin Tuitt put together a script to gather "last" data. That's if you have a good wtmp, etc. file(s). I think his file was called "audit". The above link, assuming it works, will get you to the spot. I can't see how to download the file in this forum but I'm sure there is a way.

 

Anyway, I use something like it which does basically:

 

TEMPDIR="/tmp"     ### A nice place to put files.
lastb    | sort > $TEMPDIR/lastbfile  &
lastb -R | sort > $TEMPDIR/lastbrfile &
last     | sort > $TEMPDIR/lastfile   &
last -R  | sort > $TEMPDIR/lastrfile

 

You can get login ID's, computere names or IP's (depends on your DNS settings I suppose), etc. Perhaps this can help you once your file(s) in question get fixed?

NDO
Super Advisor

Re: decode contents of wtmp file

 

Hi!

 

Since the original wtmps file is corrupted can I use the command:

cat /dev/null > /var/adm/wtmps

 

to clear the contenst of wtmps and start from fresh?

 

regards

 

 

 

 

Dennis Handly
Acclaimed Contributor

Re: decode contents of wtmp file

>can I use the command to clear the contents of wtmps and start from fresh?

 

Sure but your current file has useful info, if you want to spend time getting at it.  I.e. make a copy first.

Also, you can just clear it with: > /var/adm/wtmps

NDO
Super Advisor

Re: decode contents of wtmp file

Yes it does, but only from february this year and I have already made a copy of it.

 

regards