topic How important is wtmp in Operating System - HP-UX

How important is wtmp

joe_91 — Mon, 03 Jun 2002 11:57:19 GMT

Hi Team:

We are running on 11.0 and have the xemulator (server) running on the Unix box with client running on the PC. When the Users log from the pc (thru xemulator) the login process updates the utmp file but not the wtmp file. Now the gurus, please let me know all the disadvantages that you can point out 'coz of this behavior. I had the following points...
1. Any script running on the Unix box which references the wtmp file would break.
2. Any script, which uses commands like last, would fail.
Please note that users from the pc do *not* have telnet session and are directly put inside an xmotif application after they login.
With these points please let me know what the disadvantages are of not updating the wtmp file.
Thanks
Joe

Re: How important is wtmp

Pete Randall — Mon, 03 Jun 2002 12:03:00 GMT

Joe,

From man wtmp:

File utmp contains a record of all users logged onto the system. File
btmp contains bad login entries for each invalid logon attempt. File
wtmp contains a record of all logins and logouts.

It sounds to me like all you would lose is the record of logouts - safe enough, I would think.

Pete

Re: How important is wtmp

Helen French — Mon, 03 Jun 2002 12:28:27 GMT

Some thoughts:

1) User account auditing will not be possible.
2) Trace a particular login/user not possible.
3) Incorrect information if you enable system accounting (man 1M acct).

Also see this document (TKB # KBRC00000070) for some more inputs:

http://support2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000054952185

Re: How important is wtmp

Paula J Frazer-Campbell — Mon, 03 Jun 2002 12:45:45 GMT

Hi Joe

As you know btmp and wtmp are used with telnet and as already said tracking of users that do not use telnet is difficult.

I have a over 14000 connection/day via x25 which does not use telnet, I watch their connectivity by using ps associated with who and look for processes which do not associate with a telnet login (who).

Failing to make entry in wtmp because of their connectivity is not a problem.

Paula

Re: How important is wtmp

MANOJ SRIVASTAVA — Mon, 03 Jun 2002 13:18:37 GMT

Hi Joe

The importance also is realted to the importance of the system , I can think of the following scenarios :

1. Production system ( internal ) very critical
2. Prodcution system ( external access ) mandatory to be saved .
3.Dev system Not very critcal .

You may look at these .

http://www.ebone.at/books/programmers/sonstiges/oreillybookself/tcpip/puis/appb_01.htm

Manoj Srivastava

Re: How important is wtmp

joe_91 — Mon, 03 Jun 2002 13:30:02 GMT

Hi Manoj:

Thanks. The machine i am talking about is a production system.

Thanks
Joe.