last : Invalid record size. Unable to continue ...

[OLIVA_1]

Hello,

I have this error message when I use "last" command :

#last
Invalid record size. Unable to continue ...
#

Someone can help me ?


Thanks,

[James R. Ferguson]

Hi Oliva:

You hava a corrupted '/var/adm/wtmp' file. This happens from time to time.

If you don't want any of its contents, do:

# cat /dev/null > ?var/adm/wtmp

If, on the other hand, you want to repair the file, retaining as much of its data as possible, do:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

At this point, you may edit the /tmp/wtmp file, since it is a ASCII file.

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

Regards!

...JRF...

[Peter Godron · Accepted solution]

Hi,
and if you happen to be running 11.23:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=943509
mentions PHCO_33239

[OLIVA_1]

Hello James,

I have performed :
# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

I can read /tmp/wtmp file but last command still doesn't work...


Thanks,

[James R. Ferguson]

Hi Oliva:

The whole idea of converting the 'wtmp' file from its binary form to an Ascii one is to edit the Ascii version. Having done that, you convert it back to its binary format and overwrite the original file.

If you want to try to preserve your 'wtmp' file perform the editting I suggested, otherwise null the file.

The thread Peter cites discusses some changes if you are running 11.23.

Regards!

...JRF...

[OLIVA_1]

Thanks to all...

[koco]

You may also try to fix 'wtmps' file...