Corrupt wtmp

[Paul Thomson_2]

One of our systems currently has an ongoing issue, when someone logs on it will display they are already logged on despite there being no shell or other processes. We normally run utmp_fix to resolve. Is there any other way we can try and fix this. People log in via hp700/60-70 terminals, This is a D250 hp9000 using v11.

[Peter Kloetgen]

Hi Paul,

yes there is another way to repair the file. If you have a support contract, please call the ITO- support. They designed a tool which they can send to you to fix the problem.


Allways stay on the bright side of life!

Peter

[Frank Slootweg]

You should probably investigate why the problem re-occurs. I.e. apparently some software component is either not updating /etc/utmp or is updating it incorrectly.

[Craig Rants]

Use these couple of commands and you'll fix your problem.This occurs when who shows a user as logged on but grep is showing nothing. Make sure to note the tty assigned to the Ghost user, this will help you in step 3.

1. cd /usr/lib/acct
2. ./fwtmp < /etc/utmp > /tmp/utmp
3. edit /tmp/utmp changing 5th column to 8 for ghost user
4. ./fwtmp -ic < /tmp/utmp > /etc/utmp

GL,
C

[federico_3]

use the /usr/sbin/acct/fwtmp command in order to read the wtmp file. The form you should use is:

/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/filetemp

Then you can read the informations (you would have seen with last ) in the file /tmp/filetemp.

Bye