Simpler Navigation coming for Servers and Operating Systems
Coming soon: a much simpler Servers and Operating Systems section of the Community. We will combine many of the older boards, and you won't have to click through so many levels to get at the information you need. If you are looking for an older board and do not find it, check the consolidated boards, as the posts are still there.
cancel
Showing results for 
Search instead for 
Did you mean: 

wtmp corrupted

SOLVED
Go to solution
Damian Benavent Pla
Occasional Contributor

wtmp corrupted

When my /var is full, I release disk space but /var/adm/wtmp files remains corrupted (/usr/bin/last command dumps a core).

I used wtmpfix but /usr/bin/last dumps on.

I move wtmp to wtmp.old and create a new wtmp to log new logins. But wtmp.old is still corrupted.

How to proceed to solve the wtmp corruption ?
4 REPLIES
Hakan Dedorson
Occasional Advisor

Re: wtmp corrupted

Try moving it back from wtmp.old to wtmp (removing the version you created) and flush it with "cat /dev/null > /var/adm/wtmp"
federico_3
Honored Contributor
Solution

Re: wtmp corrupted

to read wtmp file, that now seems to be corrupted ,do like this:

the following will convert it to ASCII file
#/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/file
then you can either edit the file or read it.

Then you can convert it back to binary form:
##/usr/sbin/acct/fwtmp -ic < /tmp/file > /var/adm/wtmp


Bye
federico

Bill Hassell
Honored Contributor

Re: wtmp corrupted

Just a note about wtmp. It can become corrupted if /var fills up or by programs that write to wtmp improperly. First, I would lookk at how your system is used and consider breaking up /var into several different mountpoints. Each mountpoint will be used by a different subsystem of HP-UX and by separating them, one subsystem will not affect another (for example, spooling problems no longer affect email or logging):

/var
/var/tmp
/var/mail
/var/spool
/var/adm
/var/adm/sw

If you do not use email heavily, then the /var/mail directory can be a part of /var. Similarly, if spooling os limited to a few printers and not used for PC shares (where spool files can become gigantic), spooling can also be part of /var. /var/adm/sw should always be made separate as it will grow quite large with patches and application updates.


Bill Hassell, sysadmin
Damian Benavent Pla
Occasional Contributor

Re: wtmp corrupted

Hakan and Bill: My problem is how to recover that lost information.

Thank you Federico. I knew that procedure.