topic wtmp in Operating System - HP-UX

wtmp

David Bellamy — Thu, 01 Nov 2001 14:57:13 GMT

hi all,

i am trying to get some login info from the last command but it keeps core dumping. i tried
strings, who and more, but i dont get the info that last gives me. is there any way to rectify a bad wtmp file?

thx in advance

Re: wtmp

A. Clay Stephenson — Thu, 01 Nov 2001 15:01:02 GMT

If its truly bad, simply cp /dev/null /etc/wtmp

Re: wtmp

Robin Wakefield — Thu, 01 Nov 2001 15:04:48 GMT

Hi David,

The fwtmp command will dump out wtmp data in ascii format. Does this product corrupt data too?

Rgds, Robin.

Re: wtmp

S.K. Chan — Thu, 01 Nov 2001 15:07:10 GMT

Most likely the wtmp and btmp files are corrupted. Do this to check ..

# cp /var/adm/btmp /var/adm/btmp.old
# cp /var/adm/wtmp /var/adm/wtmp.old
# > /var/adm/btmp
# > /var/adm/wtmp
# last
==> see if it still gives error. if it does it means those files are corrupted. continue ..

# cp /var/adm/btmp.old /var/adm/btmp

# last
==> if it runs ok it means wtmp is corrupted. if it fails it means btmp is corrupted.

Repeat the last 2 steps above for wtmp file.

After the above test clear the file that has problem... (eg: if wtmp is bad) ..

# > /var/adm/wtmp

Re: wtmp

James R. Ferguson — Thu, 01 Nov 2001 15:14:28 GMT

Hi David:

If you want to start fresh, null the file:

# cat /dev/null > /var/adm/wtmp

If, on the otherhand, you want to try to correct or eliminate bad data and keep some portion of the file, do this:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

At this point, you may edit the /tmp/wtmp file, since it is a ASCII file.

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

Regards!

...JRF...