topic Re: Corrupt wtmp in Operating System - HP-UX

Corrupt wtmp

Paul Thomson_2 — Wed, 20 Feb 2002 08:47:29 GMT

One of our systems currently has an ongoing issue, when someone logs on it will display they are already logged on despite there being no shell or other processes. We normally run utmp_fix to resolve. Is there any other way we can try and fix this. People log in via hp700/60-70 terminals, This is a D250 hp9000 using v11.

Re: Corrupt wtmp

Peter Kloetgen — Wed, 20 Feb 2002 08:49:21 GMT

Hi Paul,

yes there is another way to repair the file. If you have a support contract, please call the ITO- support. They designed a tool which they can send to you to fix the problem.

Allways stay on the bright side of life!

Peter

Re: Corrupt wtmp

Frank Slootweg — Mon, 25 Feb 2002 14:41:55 GMT

You should probably investigate why the problem re-occurs. I.e. apparently some software component is either not updating /etc/utmp or is updating it incorrectly.

Re: Corrupt wtmp

Craig Rants — Mon, 25 Feb 2002 15:01:27 GMT

Use these couple of commands and you'll fix your problem.This occurs when who shows a user as logged on but grep is showing nothing. Make sure to note the tty assigned to the Ghost user, this will help you in step 3.

1. cd /usr/lib/acct
2. ./fwtmp < /etc/utmp > /tmp/utmp
3. edit /tmp/utmp changing 5th column to 8 for ghost user
4. ./fwtmp -ic < /tmp/utmp > /etc/utmp

GL,
C

Re: Corrupt wtmp

federico_3 — Mon, 25 Feb 2002 15:22:56 GMT

use the /usr/sbin/acct/fwtmp command in order to read the wtmp file. The form you should use is:

/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/filetemp

Then you can read the informations (you would have seen with last ) in the file /tmp/filetemp.

Bye