System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

create a report on user login information

paul bednarsh
Occasional Advisor

create a report on user login information

I need to creat a report on the user login information for the last 30-60 days. I tried using the last command to access the /var/adm/wtmp file, but it is corrupted.

 

Any help would be greatly appreciated...

 

thanks,

6 REPLIES
Bill Hassell
Honored Contributor

Re: create a report on user login information

>> using the last command to access the /var/adm/wtmp file, but it is corrupted.

 

Is that an error message from the last command or did you try to view the file?

The wtmp is all binary data so it will appear to be jibberish if you use vi or just cat the file.

 

If the last command reports that wtmp is corrupted then you'll have to restore and older copy from your backups.



Bill Hassell, sysadmin
paul bednarsh
Occasional Advisor

Re: create a report on user login information

# last

pid exceeds MAXPID: wtmp file corrupted

Dennis Handly
Acclaimed Contributor

Re: create a report on user login information

>/var/adm/wtmp file, but it is corrupted.

 

What HP-UX version do you have?
How important is getting the info out of the wtmp file?

 

See these other topics and KB entries:

http://h30499.www3.hp.com/t5/HP-UX-Knowledge-Base/Decoding-contents-of-wtmp-file/ta-p/5582753

http://h30499.www3.hp.com/t5/System-Administration/last-returns-no-login-info/m-p/5269768

http://h30499.www3.hp.com/t5/System-Administration/decode-contents-of-wtmp-file/m-p/5569517

 

>If the last command reports that wtmp is corrupted then you'll have to restore and older copy from your backups.

 

Unless you want to try my techniques.  :-)

 

paul bednarsh
Occasional Advisor

Re: create a report on user login information

11.11

 

I have to generate a report of users who logged in to this system for the past 30-60 days. using the last command to access the /var/adm/wtmp file is the only way i know how.

 

Of course I'm open to suggestions...what'd you have in mind?

Dennis Handly
Acclaimed Contributor

Re: create a report on user login information

>I have to generate a report of users who logged in to this system for the past 30-60 days.

 

Did you read the the links I provided?  Basically if you don't try the tips listed there, the official answer is you are out of luck, your wtmp file is corrupted and you can't get that info back.

 

>Of course I'm open to suggestions

 

The links tell you how to do the data recovery operation.  How much time and effort have you budgeted for this?

What does this show:

ll /var/adm/wtmp*

 

 

paul bednarsh
Occasional Advisor

Re: create a report on user login information

# ll /var/adm/wtmp*
-rw-rw-r--   1 adm        adm            360 Jan 24 22:34 /var/adm/wtmp
-rw-r--r--   1 root       sys              0 Jan 31  2002 /var/adm/wtmpx

 

subsequently, i found out that any time this file, or files associated with logins become 2gb in size, they become corrupted.

 

I have zeroed out the file, deleted it, and created a new one. logins have started recording..