HP-UX 11V3 Itanium and PARISC last -f /var/adm/wtmps fails

[William Henry Andrews]

Good day

MY hosts seem to be corrupting the /var/adm/wtmp and wtmps files.

I get the following issue

hptest1131:/var/adm#last -f /var/adm/wtmp
zaopsman pts/3 Thu Jan 1 02:00 still logged in
pid exceeds MAXPID: wtmp file corrupted
hptest1131:/var/adm#last -f /var/adm/wtmps
reboot Thu Jan 1 02:00 still logged in
pid exceeds MAXPID: wtmp file corrupted

I have tried all the standard fixes
(after making backup copies of the files of course)

/sbin/init.d/utmpd stop
> /var/adm/wtmp
> /var/adm/wtmps
> /var/adm/btmp
> /var/adm/btmps

then touch the files again.
/sbin/init.d/utmpd

the first couple of times that I do a last -f /var/adm/wtmps it is fine.
After a minute or so the files show as corrupt again .

However to confuse the issue the last command without the -f switch shows the correct data with no mention of corruption.

I then tried some more desperate measures.

/sbin/init.d/utmpd stop
> /var/adm/wtmp
> /var/adm/wtmps
> /var/adm/btmp
> /var/adm/btmps
> /var/adm/wtmpx
rm /etc/utmp /etc/utmps /etc/utmpx
touch /etc/utmp /etc/utmps /etc/utmpx
/sbin/init.d/utmpd start

same behaviour , fine for a minute or two , then the file shows as corrupt.

the same behaviour results if you issue the last-f command against a copy of the file.
If I do a fuser against the copied file nothing as it open.

I have also searched for patches for this issue , I could see none that applied.

Any suggestions would be appreciated.

[Pete Randall]

>pid exceeds MAXPID: wtmp file corrupted

Any guesses as to why this might be happening? What is MAXPID set to?


Pete

[Robert-Jan Goossens_1]

William,

Have a look at this thread.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1003618

Regards,
Robert-Jan

[William Henry Andrews]

should be no higher than 30 000.

hptest1131:/var/adm#kctune kctune process_id_max
Tunable Value Expression Changes
process_id_max 30000 Default Auto
hptest1131:/var/adm#kctune process_id_min
Tunable Value Expression Changes
process_id_min 0 Default Auto
hptest1131:/var/adm#kctune nproc
Tunable Value Expression Changes
nproc 30000 30000 Immed

[William Henry Andrews]

I have tried converting the files to asci using fwtmp.
the files appear to be corrupt , as most of the entries have a date of Jan 1 1970

username 0 0 0000 0000 0 Jan 1 02:00:00 1970

fwtmpfix , on a system with a large enough /tmp , breaks halfway through.

Even if I wipe all the files and start from scratch , as per the entry above , the new file is corrupted within a minute.

this is happening on 4 seperate hosts all running the same OS revision.

[William Henry Andrews]

MY apologies , the OS involved is HP-UX 11V3

[William Henry Andrews]

This could have been happening for a while as I quite rarely access the archived files.

The issue would not be visible until you tried to access a old wtmps file.

[William Henry Andrews]

Below see the results of running the wtmpfix against one of the files.


/usr/sbin/acct/wtmpfix /STATIC/wtmpfiles/wtmps > wtmps.fixed
Unable to write record to output file. Exiting ...

ll wtmps.fixed
-rw-r----- 1 root sys 371714980 Jan 7 16:18 wtmps.fixed

last -f STATIC/wtmpfiles
pid exceeds MAXPID: wtmp file corrupted

[Dennis Handly]

>last -f /var/adm/wtmp

This should work but typically this file only has "system boot" in it.

>last command without the -f switch

There are three types of wtmp files.
last(1) looks at wtmps. With -f it looks at wtmp. And with -X wtmps.

If you don't have the right options, the file will look corrupt.

[William Henry Andrews]

Thanks Dennis

The -X option does not report corruption , but it also gives no data back.

last -X /var/adm/wtmps

WTMPS_FILE begins at Sat Jan 12 22:27:43


when combined with -f it comes back with invalid record size.
last -f /SCRATCH/wtmpfx/wtmp -X /SCRATCH/wtmpfx/wtmps
Invalid record size. Unable to continue ...

However If I replace the existing wtmps file with the restored one the last command reports on all the data as expected.

That will suffice , as i can then restore the file to a test system, get the data , and remove the old one once I have the data required.