`who -b ` does not produce any information

[SKR_1]

What about below command

who -b /var/adm/wtmp

Thanks

SKR

[Kennedy G. Doss]

Here is the output:

root:/:# who -b /var/adm/wtmp | head -10
. system boot Aug 24 11:47
. system boot Aug 25 17:47
. system boot Aug 27 14:24
. system boot Aug 27 15:54
. system boot Aug 27 16:31
. system boot Aug 27 16:42
. system boot Aug 30 13:18
. system boot Aug 30 15:58
. system boot Aug 30 18:26
. system boot Aug 31 12:43
root:/:#

[Dennis Handly]

>Here is an output of the "last reboot".

Ok, this data source is working.

>who -b /var/adm/wtmp | head -10

And this data source. (You really need tail -10.)

What is your real problem?
It appears that out of utmp/utmpx, utmpd, wtmp* some of those files have been truncated.

[Kennedy G. Doss]

Dennis,

My DBA Teams have "who -b" embedded in many of their automated scripts. Since it is not working now, all their scripts trigger off unwanted alerts. I know, if I reboot his server it may start working again without any issues. I just need to know if I can avoid a reboot. I also want to ensure that this is not any patch related issue which can be resolved without a reboot. (And you are correct, I should have done a tail -10 instead of head -10).

-Kennedy

[Dennis Handly]

>My DBA Teams have "who -b" embedded in many of their automated scripts. Since it is not working now, all their scripts trigger off unwanted alerts.

Ah, the real problem.

>if I reboot his server it may start working again without any issues. I just need to know if I can avoid a reboot.

The first thing to do would be to figure out where "who -b" is getting its data. You could use tusc to figure this out. This would be helpful so you know what not to do next time, truncate file?

Then you have several choices:
1) Reboot
2) Live with it until you until the other choices fix it.
3) Change the scripts to use "uptime" or "who -b /var/adm/wtmp" if "who -b" fails. Or just have it read the info from some manually created file in /etc/.
4) Write a program to fiddle with the data source.

Obviously 1) is pretty simple. 3) would be next.

>I also want to ensure that this is not any patch related issue which can be resolved without a reboot.

I seriously doubt that.

[Dennis Handly]

>ME: 4) Write a program to fiddle with the data source.

I used tusc and on 11.11 it seems that "who -b" (and so does uptime) opens /etc/utmp directly and reads it. So if this file has been truncated, you lost that info. I have no idea how uptime can give you some info?

We haven't asked you to do:
last -f /etc/utmp reboot

Using who -b /var/adm/wtmp would give info for users that aren't still logged on.

[Kennedy G. Doss]

I think we got into this issue because / filesystem got filled up and the /etc/utmp file for this reason gor initialized or lost some of the contents. This is what I had to do to repair/resolve the "who -b" issue:

To fix who -b issue:



Perform as root:
1) Create the ASCII version of utmp
# /usr/sbin/acct/fwtmp < /etc/utmp > /etc/utmp.ASCII



2) Edit the ASCII version
# vi /etc/utmp.ASCII
search for the system boot line (which probably isn't there) so add it!
duplicate the run-level line for the system boot line
ie. copy
run-level 3 0 1 0063 0123 850661195 Dec 15 08:46:35 1996
to look like
system boot 0 2 0000 0000 850661195 Dec 15 08:46:35 1996



3) Convert the ASCII back to BINARY
# /usr/sbin/acct/fwtmp -ic < /etc/utmp.ASCII > /etc/utmp.BIN



4) Save the original
# cp /etc/utmp /etc/utmp.SAVE



5) Make the new file active
# cp /etc/utmp.BIN /etc/utmp



6) Verify dates and who command
# who -b


I got this solution by opening up a ticket with the response center. I didnt find this solution when I searched at ITRC though.

Regards,
-Kennedy