cancel
Showing results for 
Search instead for 
Did you mean: 

wtmp

David Bellamy
Respected Contributor

wtmp

hi all,

i am trying to get some login info from the last command but it keeps core dumping. i tried
strings, who and more, but i dont get the info that last gives me. is there any way to rectify a bad wtmp file?

thx in advance
4 REPLIES
A. Clay Stephenson
Acclaimed Contributor

Re: wtmp

If its truly bad, simply cp /dev/null /etc/wtmp
If it ain't broke, I can fix that.
Robin Wakefield
Honored Contributor

Re: wtmp

Hi David,

The fwtmp command will dump out wtmp data in ascii format. Does this product corrupt data too?

Rgds, Robin.
S.K. Chan
Honored Contributor

Re: wtmp

Most likely the wtmp and btmp files are corrupted. Do this to check ..

# cp /var/adm/btmp /var/adm/btmp.old
# cp /var/adm/wtmp /var/adm/wtmp.old
# > /var/adm/btmp
# > /var/adm/wtmp
# last
==> see if it still gives error. if it does it means those files are corrupted. continue ..

# cp /var/adm/btmp.old /var/adm/btmp

# last
==> if it runs ok it means wtmp is corrupted. if it fails it means btmp is corrupted.

Repeat the last 2 steps above for wtmp file.

After the above test clear the file that has problem... (eg: if wtmp is bad) ..

# > /var/adm/wtmp

James R. Ferguson
Acclaimed Contributor

Re: wtmp

Hi David:

If you want to start fresh, null the file:

# cat /dev/null > /var/adm/wtmp

If, on the otherhand, you want to try to correct or eliminate bad data and keep some portion of the file, do this:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

At this point, you may edit the /tmp/wtmp file, since it is a ASCII file.

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

Regards!

...JRF...