Simpler Navigation for Servers and Operating Systems
Completed: a much simpler Servers and Operating Systems section of the Community. We combined many of the older boards, so you won't have to click through so many levels to get at the information you need. Check the consolidated boards here as many sub-forums are now single boards.
cancel
Showing results for 
Search instead for 
Did you mean: 

wtmp

David Bellamy
Respected Contributor

wtmp

hi all,

i am trying to get some login info from the last command but it keeps core dumping. i tried
strings, who and more, but i dont get the info that last gives me. is there any way to rectify a bad wtmp file?

thx in advance
4 REPLIES
A. Clay Stephenson
Acclaimed Contributor

Re: wtmp

If its truly bad, simply cp /dev/null /etc/wtmp
If it ain't broke, I can fix that.
Robin Wakefield
Honored Contributor

Re: wtmp

Hi David,

The fwtmp command will dump out wtmp data in ascii format. Does this product corrupt data too?

Rgds, Robin.
S.K. Chan
Honored Contributor

Re: wtmp

Most likely the wtmp and btmp files are corrupted. Do this to check ..

# cp /var/adm/btmp /var/adm/btmp.old
# cp /var/adm/wtmp /var/adm/wtmp.old
# > /var/adm/btmp
# > /var/adm/wtmp
# last
==> see if it still gives error. if it does it means those files are corrupted. continue ..

# cp /var/adm/btmp.old /var/adm/btmp

# last
==> if it runs ok it means wtmp is corrupted. if it fails it means btmp is corrupted.

Repeat the last 2 steps above for wtmp file.

After the above test clear the file that has problem... (eg: if wtmp is bad) ..

# > /var/adm/wtmp

James R. Ferguson
Acclaimed Contributor

Re: wtmp

Hi David:

If you want to start fresh, null the file:

# cat /dev/null > /var/adm/wtmp

If, on the otherhand, you want to try to correct or eliminate bad data and keep some portion of the file, do this:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

At this point, you may edit the /tmp/wtmp file, since it is a ASCII file.

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

Regards!

...JRF...