topic Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails in Operating System - HP-UX

HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

William Henry Andrews — Thu, 07 Jan 2010 13:11:54 GMT

Good day

MY hosts seem to be corrupting the /var/adm/wtmp and wtmps files.

I get the following issue

hptest1131:/var/adm#last -f /var/adm/wtmp
zaopsman pts/3 Thu Jan 1 02:00 still logged in
pid exceeds MAXPID: wtmp file corrupted
hptest1131:/var/adm#last -f /var/adm/wtmps
reboot Thu Jan 1 02:00 still logged in
pid exceeds MAXPID: wtmp file corrupted

I have tried all the standard fixes
(after making backup copies of the files of course)

/sbin/init.d/utmpd stop
> /var/adm/wtmp
> /var/adm/wtmps
> /var/adm/btmp
> /var/adm/btmps

then touch the files again.
/sbin/init.d/utmpd

the first couple of times that I do a last -f /var/adm/wtmps it is fine.
After a minute or so the files show as corrupt again .

However to confuse the issue the last command without the -f switch shows the correct data with no mention of corruption.

I then tried some more desperate measures.

/sbin/init.d/utmpd stop
> /var/adm/wtmp
> /var/adm/wtmps
> /var/adm/btmp
> /var/adm/btmps
> /var/adm/wtmpx
rm /etc/utmp /etc/utmps /etc/utmpx
touch /etc/utmp /etc/utmps /etc/utmpx
/sbin/init.d/utmpd start

same behaviour , fine for a minute or two , then the file shows as corrupt.

the same behaviour results if you issue the last-f command against a copy of the file.
If I do a fuser against the copied file nothing as it open.

I have also searched for patches for this issue , I could see none that applied.

Any suggestions would be appreciated.

Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

Pete Randall — Thu, 07 Jan 2010 13:47:52 GMT

>pid exceeds MAXPID: wtmp file corrupted

Any guesses as to why this might be happening? What is MAXPID set to?

Pete

Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

Robert-Jan Goossens_1 — Thu, 07 Jan 2010 14:00:32 GMT

William,

Have a look at this thread.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1003618

Regards,
Robert-Jan

Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

William Henry Andrews — Thu, 07 Jan 2010 14:06:55 GMT

should be no higher than 30 000.

hptest1131:/var/adm#kctune kctune process_id_max
Tunable Value Expression Changes
process_id_max 30000 Default Auto
hptest1131:/var/adm#kctune process_id_min
Tunable Value Expression Changes
process_id_min 0 Default Auto
hptest1131:/var/adm#kctune nproc
Tunable Value Expression Changes
nproc 30000 30000 Immed

Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

William Henry Andrews — Thu, 07 Jan 2010 14:14:47 GMT

I have tried converting the files to asci using fwtmp.
the files appear to be corrupt , as most of the entries have a date of Jan 1 1970

username 0 0 0000 0000 0 Jan 1 02:00:00 1970

fwtmpfix , on a system with a large enough /tmp , breaks halfway through.

Even if I wipe all the files and start from scratch , as per the entry above , the new file is corrupted within a minute.

this is happening on 4 seperate hosts all running the same OS revision.

Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

William Henry Andrews — Thu, 07 Jan 2010 14:19:29 GMT

MY apologies , the OS involved is HP-UX 11V3

Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

William Henry Andrews — Thu, 07 Jan 2010 14:22:19 GMT

This could have been happening for a while as I quite rarely access the archived files.

The issue would not be visible until you tried to access a old wtmps file.

Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

William Henry Andrews — Thu, 07 Jan 2010 14:35:35 GMT

Below see the results of running the wtmpfix against one of the files.

/usr/sbin/acct/wtmpfix /STATIC/wtmpfiles/wtmps > wtmps.fixed
Unable to write record to output file. Exiting ...

ll wtmps.fixed
-rw-r----- 1 root sys 371714980 Jan 7 16:18 wtmps.fixed

last -f STATIC/wtmpfiles
pid exceeds MAXPID: wtmp file corrupted

Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

Dennis Handly — Fri, 08 Jan 2010 09:30:25 GMT

>last -f /var/adm/wtmp

This should work but typically this file only has "system boot" in it.

>last command without the -f switch

There are three types of wtmp files.
last(1) looks at wtmps. With -f it looks at wtmp. And with -X wtmps.

If you don't have the right options, the file will look corrupt.

Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

William Henry Andrews — Fri, 08 Jan 2010 10:45:41 GMT

Thanks Dennis

The -X option does not report corruption , but it also gives no data back.

last -X /var/adm/wtmps

WTMPS_FILE begins at Sat Jan 12 22:27:43

when combined with -f it comes back with invalid record size.
last -f /SCRATCH/wtmpfx/wtmp -X /SCRATCH/wtmpfx/wtmps
Invalid record size. Unable to continue ...

However If I replace the existing wtmps file with the restored one the last command reports on all the data as expected.

That will suffice , as i can then restore the file to a test system, get the data , and remove the old one once I have the data required.

Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

Dennis Handly — Fri, 08 Jan 2010 16:46:55 GMT

>The -X option does not report corruption, but it also gives no data back.

You need to read last(1). The syntax is:
last -X -f /SCRATCH/wtmpfx/wtmps

Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

William Henry Andrews — Wed, 13 Jan 2010 12:09:03 GMT

Thank you VERY much Dennis.
That sorted it out.

I misread the last man page, my Apologies for that.

Re: HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

William Henry Andrews — Wed, 13 Jan 2010 12:17:03 GMT

The last -X -f filename works on the wtmps file format.
Thank you very much for the assistance