topic Re: filling wtmp in Operating System - HP-UX

filling wtmp

Anders Gullberg — Tue, 02 Sep 2003 07:39:03 GMT

Hi all,
I have some problems something that filling up wtmp.
When i run strings /var/adm/wtmp i got a lot of mess that says:

mxlogmgrcms4
?TUp

First i thought it be something with SCM (service control manager) so unstall it, but the problem still exist.

Anyone that have clue what it could be?

Regards Anders

Re: filling wtmp

Tim Adamson_1 — Tue, 02 Sep 2003 07:46:13 GMT

The wtmp file is a binary file. The strings command may produce some garbage output. If you want to check the contents, use the fmtmp command and if it needs fixing use fwtmpfix.

Refer to the fwtmp(1M) man page for more information.

Tim

Re: filling wtmp

Massimo Bianchi — Tue, 02 Sep 2003 08:25:09 GMT

Look at these threads:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x90b04a988422d711abdc0090277a778c,00.html

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x2fb8a2db8513d6118ff40090279cd0f9,00.html

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xdca553921f1ad5118fef0090279cd0f9,00.html

Massimo

Re: filling wtmp

T G Manikandan — Tue, 02 Sep 2003 08:38:18 GMT

convert to ascii format and view the enttries # /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

Re: filling wtmp

Elena Leontieva — Tue, 02 Sep 2003 12:06:51 GMT

To read wtmp:

cat /var/adm/wtmp | /usr/sbin/acct/fwtmp

To clear it out, do a copy first and then clear it:

cp /var/adm/wtmp /var/adm/wtmp.old
> /var/adm/wtmp

Elena.

Re: filling wtmp

Anders Gullberg — Thu, 04 Sep 2003 13:09:36 GMT

Hi all
Thanks for your quick response!
I know its a binaryfile and so on. My question was really if anyone could recognize the message to any command,demon, process, applikation or what ever.

Iv still dont figured out what it is that writing this in the file.

//Anders

Re: filling wtmp

Elena Leontieva — Thu, 04 Sep 2003 14:13:57 GMT

Andres,

Just in case you do not have this document that shows the steps to remove it:
Document description: How do I remove Service Control Manager (SCM) from the CMS.
Document id: KBRC00002536

http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000065556675

Elena.

Re: filling wtmp

John Dvorchak — Thu, 04 Sep 2003 14:21:19 GMT

To answer your question you can man wtmp. Here is the first couple of lines from that man page. Wtmp is filled with data by the login process. You can't stop it from being populated but you can and should trim it occasionally but using the tips given by the other respondents.

utmp(4) utmp(4)

NAME
utmp, wtmp, btmp - utmp, wtmp, btmp entry format

SYNOPSIS
#include
#include

DESCRIPTION
These files, which hold user and accounting information for such
commands as last, who, write, and login (see last(1), who(1),
write(1), and login(1)), have the following structure as defined by
:

Re: filling wtmp

Darrell Allen — Thu, 04 Sep 2003 14:48:24 GMT

I presume mxlogmgr is not running on your system. Could it be running on another host(s) and logging to your host? Just a guess since I'm not familiar with SCM.

You might try these commands to see if you get any clues as to where the access is from:

last -R
who -a /var/adm/wtmp

Darrell

Re: filling wtmp

Paddy_1 — Fri, 05 Sep 2003 14:13:09 GMT

man getutline

will give you all the tools necessary to perform your task.its fairly simple.