topic wtmp gets filled in Operating System - HP-UX

wtmp gets filled

jim bidebo — Tue, 29 Jan 2002 13:39:49 GMT

have a problem... /var/adm/wtmp gets filled...
it looks like this when i use the "last" command:
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
....

ps -edf |grep pts/0 doesnt give any information...
does anyone know what this can be?

Re: wtmp gets filled

Sebastian Galeski_1 — Tue, 29 Jan 2002 14:59:24 GMT

Hi
perform;
# > /var/adm/wtmp
or SAM-> Routine Tasks ->System Log Files and trim to zero /var/adm/wtmp by menu action->trim -. trim to zero

hope it help

Re: wtmp gets filled

Helen French — Tue, 29 Jan 2002 15:15:59 GMT

Hi Jim,

Which OS version ? which server ? Do you have any cron job running which causes this ? Do you use Reflection for logging in ?

Try 'fuser' command to see what processes are running on pts/0. Also

# touch /var/adm/wtmp

HTH,
Shiju

Re: wtmp gets filled

Corthouts Carlo — Fri, 01 Feb 2002 10:55:08 GMT

The file /var/adm/wtmp contains a record of all logins and logouts.

The files can be zeroed or removed but if they are removed they need to be
manually recreated as they are not created by the programs that maintain them.

If you want to recreate them note the ownerships and permissions before removing them and reset the ownerships and permissions after recreating the files (usually with touch to create an empty files). This is EXTREMELY
important

Re: wtmp gets filled

Trond Haugen — Fri, 01 Feb 2002 11:25:26 GMT

The problem here is not actually wtmp filling up but finding what is filling it up.
The entries you describe show that root has logged in (and out again) 7 times within a minute. You will not find the pty in the ps list unless the line reads something like:
root console Mon Feb 21 10:30 still logged in

So your detective work will be to figure out what is causing this. Could be a cron job, a script or ..anything.
I would suggest starting by trying to find a pattern in when and how many entries there are.
In my view nilling out the wtmp file will only clear the symptom unless of course there is a valid reason for the entries.

Re: wtmp gets filled

federico_3 — Fri, 01 Feb 2002 12:45:49 GMT

use the /usr/sbin/acct/fwtmp command in order to read the wtmp file. The form you should use is:

/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/filetemp

Then you can read the informations (you would have seen with last ) in the file /tmp/filetemp.

Bye

Re: wtmp gets filled

Paula J Frazer-Campbell — Fri, 01 Feb 2002 13:25:15 GMT

Jim

I you can stop the cron for long enough to examine the wtmp and see if this is cron related.

/sbin/init.d/cron stop
/sbin/init.d/cron start

HTH

Paula

Re: wtmp gets filled

Corthouts Carlo — Fri, 01 Feb 2002 13:52:50 GMT

Could you tell us what version of HP-UX you are using?

Re: wtmp gets filled

jim bidebo — Mon, 21 Oct 2002 14:33:39 GMT

Not as hard as it seamed, the problem was that it tried to start a dtlogin session at the local display, but no local display was attached.
Solved now.