who -r not working

[Roman Schmidt]

well, i think i've got some idea what could it be. if i study the tusc output and compare that to the one of another hpux machine i seems that 'who -r' searches for following entries in /etc/utmp:

system boot
run-level

so if the entries would be like:

system boot
run-level 3

then getrunlvl shows:
New_level 3 Old_level S


i can't find both of these entries in /etc/utmp on the machine with issues.
it really seems that this file got messed up (or deleted some time ago).

is there a way to make this file valid again without a reboot?

[Patrick Wallek]

>>is there a way to make this file valid again
>>without a reboot?

Not that I know of.

[Roman Schmidt]

ok thanks for help. i guess we have to live with that until the next reboot.

[Dennis Handly · Accepted solution]

>is there a way to make this file valid again without a reboot?

Sure, write a program.
Since you are on 11.11 you probably don't need to do that.

>Patrick: Not that I know of.

Right, there is no specific command(s) that will fix it. And even harder on 11.23 since there is utmps & utmpd.

>I guess we have to live with that until the next reboot.

(See easier way below, first.)
If you are ambitious you might try the following:
1) Back up /etc/utmp in case we make it worse.
2) You might be able to extract the info from a good system with dd(1).
3) Then use "cat >> /etc/utmp" to append to the end.
4) They try "who -r".

>if I study the tusc output and compare that to the one of another hp-ux machine it seems that 'who -r' searches for following entries in /etc/utmp:
system boot run-level

Of course. See utmp(4):
http://docs.hp.com/en/B2355-60130/utmp.4.html

Just use tusc on a good system to compute where the good record is, then use dd to extract it.

In your tusc dump on the bad system, suppose this is the entry you want to copy:
read(5, "x x x x x x x \0t s / 7 p t s / ".., 60)
Counting from 0, this is record 7:
dd if=/etc/utmp of=runlevel bs=60 iseek=7 count=1

Then just copy to the bad system and do:
cat runlevel >> /etc/utmp

Actually since it is /etc/utmp you can do:
1) On good system:
2) /usr/sbin/acct/fwtmp < /etc/utmp | grep "run-level " > runlevel
3) Copy runlevel to bad system
4) On bad system
5) /usr/sbin/acct/fwtmp < /etc/utmp > utmp.txt
6) cat runlevel >> utmp.txt
7) cp /etc/umtp utmp.save
8) /usr/sbin/acct/fwtmp -ic < utmp.txt > /etc/utmp

>I can't find both of these entries in /etc/utmp on the machine with issues.

Yes, someone emptied out /etc/utmp and lost that entry.

[Roman Schmidt]

hi,

i'll see what the customer says on monday and if he insist i'll try to recover the file.

thanks for the info :)

[Roman Schmidt]

closing