topic Re: last command error in Operating System - HP-UX

last command error

V. V. Ravi Kumar_1 — Mon, 10 Jun 2002 13:56:21 GMT

hi all,

iam getting the following error when i issue the last command. but lastb working fine. wtmp file exists in /var/adm. what could be the reason. it is hp-ux 11.0 system.

Memory fault(corddump)

thanks in advance
ravi

Re: last command error

Jeff Schussele — Mon, 10 Jun 2002 14:02:35 GMT

Hi Ravi,

Suspect the wtmp file is corrupt.
last checks it whereas lastb checks the btmp file.

HTH,
Jeff

Re: last command error

Shahul — Mon, 10 Jun 2002 14:04:12 GMT

Hi

Please check up the permission and owner of /var/adm/wtmp file.

It should be 664 adm adm. If still problem follow this

#cd /var/adm
#cp wtmp wtmp.org
#>wtmp
#last

Now U see whether it is giving any error or not.. If still problem , then something wrong with /usr/bin/last command.

Best of luck
Shahul

Re: last command error

S.K. Chan — Mon, 10 Jun 2002 14:04:19 GMT

The "last" command query /var/adm/wtmp while "lastb" query /var/adm/btmp. So if you're getting core dump on "last", most probably /var/adm/wtmp is corrupted.

Do this ..
# cd /var/adm
# mv wtmp wtmp.old
# touch wtmp
==> retain the same permission/ownership as wtmp.old
# last

If it's ok, then it's confirmed "wtmp" is corrupted.

Re: last command error

MANOJ SRIVASTAVA — Mon, 10 Jun 2002 14:06:52 GMT

Hi Ravi

The wtmp file is corrupt , please recreate it using :

to read wtmp file, that now seems to be corrupted ,do like this:

the following will convert it to ASCII file
#/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/file
then you can either edit the file or read it.

Then you can convert it back to binary form:
##/usr/sbin/acct/fwtmp -ic < /tmp/file > /var/adm/wtmp

Manoj Srivastava

Re: last command error

V. V. Ravi Kumar_1 — Mon, 10 Jun 2002 14:49:55 GMT

thank u all
regds
ravi

Re: last command error

Nick Wickens — Mon, 10 Jun 2002 15:17:44 GMT

When I had corruption in the wtmp file the corruption was always indicated by 1970 date stamps and I had to use /usr/lib/acct/wtmpfix < /etc/wtmp > wtmpfix.new to fix the time stamps - see man page for wtmpfix

Re: last command error

Helen French — Mon, 10 Jun 2002 15:57:10 GMT

A better explanation from here (TKB #KBRC00001970):

http://support2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000058668889