topic Re: "last" command dumps core - HP-UX 11.00 in Operating System - HP-UX

"last" command dumps core - HP-UX 11.00

Brian Williams_5 — Thu, 18 Oct 2001 17:00:57 GMT

How do I fix this problem?!

# whoami
root

# uname -a
HP-UX pokie B.11.00 U 9000/800 1514750538 unlimited-user license

# last
Memory fault(coredump)

# file core
core: core file from 'last' - received SIGSEGV

Re: "last" command dumps core - HP-UX 11.00

harry d brown jr — Thu, 18 Oct 2001 17:13:29 GMT

If it used to work, and now it is failing then either your btmp or wtmp file is corrupt.

Re: "last" command dumps core - HP-UX 11.00

James R. Ferguson — Thu, 18 Oct 2001 17:22:33 GMT

Hi Brian:

This should fix your problem:

# cat /dev/null > /var/adm/wtmp

Regards!

...JRF...

Re: "last" command dumps core - HP-UX 11.00

Brian Williams_5 — Thu, 18 Oct 2001 17:25:27 GMT

Hi Harry,

I have both files:

# ls -altr /var/adm/btmp
-rw------- 1 root other 4500 Oct 18 13:12 /var/adm/btmp
# ls -altr /var/adm/wtmp
-rw-rw-r-- 1 adm adm 161336 Oct 18 13:59 /var/adm/wtmp

How do I tell which is corrupted?

Thanks,
/ Brian

Re: "last" command dumps core - HP-UX 11.00

linuxfan — Thu, 18 Oct 2001 17:29:57 GMT

Hi Brian,

last command gets its information from wtmp file where as lastb gets it from btmp.

In your case looks like wtmp is corrupted.

you could try "cat /dev/null > /var/adm/wtmp"

-HTH
Ramesh

Re: "last" command dumps core - HP-UX 11.00

Brian Williams_5 — Thu, 18 Oct 2001 17:37:24 GMT

Yes, "last" was working before and then mysteriously stopped. I *think* it was after I used sam to change some kernel parameters (maxdsiz, etc.) that it stopped working.

But the "cat /dev/null > /var/adm/wtmp" command fixed this problem. Thanks.

Re: "last" command dumps core - HP-UX 11.00

James R. Ferguson — Thu, 18 Oct 2001 17:51:19 GMT

Hi Brian:

One more trick. If you ever need/want to preserve your 'wtmp' and/or 'btmp' file, but it is corrupted, or you simply want to trim it, then you can "edit" it like this:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

At this point, you may edit the /tmp/wtmp file, since it is a ASCII file.

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

Regards!

...JRF...

Re: "last" command dumps core - HP-UX 11.00

Roger Baptiste — Thu, 18 Oct 2001 20:03:41 GMT

Brian,

You can use /usr/sbin/acct/wtmpfix command
to try fixing the corrupt
wtmp file. If it doesn't
work you can preserve
the ascii version of the file
by running fwtmp .

-raj