last command

[Mani Pushpanathan]

The output from last command is
wtmp begins Thu Oct 13 22:32

It doesn't show me all the logon connections. I'm on HPUX 11i. Can someone tell me what's wrong?

[MarkSyder]

Someone has nulled the wtmp file, probably because it was too large.

Mark Syder (like the drink but spelt different)

[Mel Burslan]

check your crontab. More often than not, I have seen previous sysadmins put a daily/weekly job to zero out the wtmp file just because there are too many entries in it gets accumulated.

Also keep in mind that, sometimes this file gets corrupted and there is no other recovery than zeroing it out.

[Michael Jorgensen]

Mani,

The fact that it is saying that wtmp begins on today's (well at least your post date) date means that something has wiped out the history of logins on your host.

wtmp is the file where this information is stored and last is telling you that the file only started today... that's why you don't see anything.

[Mani Pushpanathan]

Guys
Its true that I nulled the file yesterday because prior to that I was still getting no output from the command although I've done numerous logins earlier. This morning, the output shows a different date and nothing else. Pretty strange. see below

# ls -l w*
-rw-rw-r-- 1 adm adm 11761 Oct 14 09:02 wtmp
-rw------- 1 root sys 280 Sep 16 16:19 wtmpx
# last

wtmp begins Sat Sep 21 20:47

[Arunvijai_4]

Try to check any cron jobs are running in the system. what does your lastb command show ? Just curious to know..

[I have assigned points to 0 of 16 responses to my questions.] Make it 16/16 and you will get more replies.

-Arun

[Muthukumar_5 · Accepted solution]

Just do check points as,

a) permission of /var/adm directory

# ls -ld /var/adm
drwxr-xr-x 12 adm adm 8192 Oct 14 00:39 /var/adm

b) # ls -l wtmp
-rw-rw-rw- 1 adm adm 420 Oct 14 00:49 wtmp

Next level:

# mv /var/adm/wtmp /var/adm/wtmp.old
# touch /var/adm/wtmp
# chmod 664 /var/adm/wtmp

Try with new (few) logins and audit it.

# last -f /var/adm/wtmp

If it is not working then,

# uname -a
# what `which login`

Post this.

hth.
# chown adm:adm /var/adm/wtmp

[Mei Jiao]

Hi Mani,

Yes, please try this:
# mv /var/adm/wtmp /var/adm/wtmp.old
# touch /var/adm/wtmp
# chmod 664 /var/adm/wtmp
# chown adm:adm /var/adm/wtmp

Try login and run command "last" again to see how.

BR,
Mei

[Mani Pushpanathan]

Thks Muthukumar. It works now.