topic Re: Core Dump - last command in Operating System - HP-UX

Core Dump - last command

Soumen Ghosh_1 — Thu, 19 Sep 2002 04:40:05 GMT

Hello,

On HP-UX 11, last command is giving core dump. wtmp file exists under /var/adm directory. There is no problem regarding access permission of wtmp file and last was executed as root. I can also issue file command to check the type of wtmp file. It shows - data.

Any idea what could go wrong?

I can issue lastb command to get the login history from btmp file.

Thanks in advance.

Soumen Ghosh

Re: Core Dump - last command

T G Manikandan — Thu, 19 Sep 2002 04:48:47 GMT

check this hp doc

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&admit=-682735245+1032414807216+28353475&docId=200000058668889

Thanks

Re: Core Dump - last command

T G Manikandan — Thu, 19 Sep 2002 04:49:10 GMT

you can do a
cat /dev/null > /var/adm/wtmp

Before you do this copy the original file to wtmp.old

You can extract the contents by
#/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmpfile

Thanks

Re: Core Dump - last command

Animesh Chakraborty — Thu, 19 Sep 2002 04:53:03 GMT

Hi,
The file /var/adm/btmp contains bad login entries for each invalid logon
attempt and the file /var/adm/wtmp contains a record of all logins and
logouts. See the man page utmp(4) for more information.

They are binary data files, so they cannot be read directly. The can however
be read with the following commands:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp
# /usr/sbin/acct/fwtmp < /var/adm/btmp

The "last" and "lastb" commands display the information is a readable format.

The files can be zeroed or removed but if they are removed they need to be
manually recreated as they not created by the programs that maintain them.
Thus, if these files are removed, record-keeping is turned off.

If you want to recreate them note the ownerships and permissions before
removing them and reset the ownerships and permissions after recreating the
files (usually with touch to create an empty files). This is EXTREMELY
important -> especially for the btmp file.

In your case i think wtmp file is corrupted .pls recreate it.

Re: Core Dump - last command

Ravi_8 — Thu, 19 Sep 2002 05:21:53 GMT

Hi ghosh

/var/adm/wtmp file may be corrupted,
#cd /var/adm
#cp wtmp wtmp.old
# rm wtmp
#touch wtmp
#mv wtmp.old wtmp
#chmod 0644 wtmp
#last
should work now.