topic Re: last command in Operating System - HP-UX

last command

Mani Pushpanathan — Thu, 13 Oct 2005 09:44:34 GMT

The output from last command is
wtmp begins Thu Oct 13 22:32

It doesn't show me all the logon connections. I'm on HPUX 11i. Can someone tell me what's wrong?

Re: last command

MarkSyder — Thu, 13 Oct 2005 09:47:41 GMT

Someone has nulled the wtmp file, probably because it was too large.

Mark Syder (like the drink but spelt different)

Re: last command

Mel Burslan — Thu, 13 Oct 2005 09:50:53 GMT

check your crontab. More often than not, I have seen previous sysadmins put a daily/weekly job to zero out the wtmp file just because there are too many entries in it gets accumulated.

Also keep in mind that, sometimes this file gets corrupted and there is no other recovery than zeroing it out.

Re: last command

Michael Jorgensen — Thu, 13 Oct 2005 18:55:28 GMT

Mani,

The fact that it is saying that wtmp begins on today's (well at least your post date) date means that something has wiped out the history of logins on your host.

wtmp is the file where this information is stored and last is telling you that the file only started today... that's why you don't see anything.

Re: last command

Mani Pushpanathan — Thu, 13 Oct 2005 20:26:23 GMT

Guys
Its true that I nulled the file yesterday because prior to that I was still getting no output from the command although I've done numerous logins earlier. This morning, the output shows a different date and nothing else. Pretty strange. see below

# ls -l w*
-rw-rw-r-- 1 adm adm 11761 Oct 14 09:02 wtmp
-rw------- 1 root sys 280 Sep 16 16:19 wtmpx
# last

wtmp begins Sat Sep 21 20:47

Re: last command

Arunvijai_4 — Thu, 13 Oct 2005 22:57:16 GMT

Try to check any cron jobs are running in the system. what does your lastb command show ? Just curious to know..

[I have assigned points to 0 of 16 responses to my questions.] Make it 16/16 and you will get more replies.

-Arun

Re: last command

Muthukumar_5 — Fri, 14 Oct 2005 02:05:08 GMT

Just do check points as,

a) permission of /var/adm directory

# ls -ld /var/adm
drwxr-xr-x 12 adm adm 8192 Oct 14 00:39 /var/adm

b) # ls -l wtmp
-rw-rw-rw- 1 adm adm 420 Oct 14 00:49 wtmp

Next level:

# mv /var/adm/wtmp /var/adm/wtmp.old
# touch /var/adm/wtmp
# chmod 664 /var/adm/wtmp

Try with new (few) logins and audit it.

# last -f /var/adm/wtmp

If it is not working then,

# uname -a
# what `which login`

Post this.

hth.
# chown adm:adm /var/adm/wtmp

Re: last command

Mei Jiao — Fri, 14 Oct 2005 02:38:21 GMT

Hi Mani,

Yes, please try this:
# mv /var/adm/wtmp /var/adm/wtmp.old
# touch /var/adm/wtmp
# chmod 664 /var/adm/wtmp
# chown adm:adm /var/adm/wtmp

Try login and run command "last" again to see how.

BR,
Mei

Re: last command

Mani Pushpanathan — Fri, 14 Oct 2005 02:56:15 GMT

Thks Muthukumar. It works now.