corrupted btmp wtmp

[aparna challagulla]

hi all,

i have corrupted btmp,wtmp files on HP-ux 11i A class machine. how do i rectify this problem?

The error that i get is
#last
pid exceeds MAXPID: wtmp file corrupted

please help me
aparna

[Brian Markus]

Try recreating the files. (backup the old ones)

> btmp
> wtmp

It should just start writing the new entrys in the clean file.

Hope this helps.

-Brian

[RAC_1]

Check man page of fwtmp. It will read wtmp,btmp file put it in acsii files and read it back to wtmp and btmp files.

OR

just

>wtmp
>btmp

[Robert-Jan Goossens · Accepted solution]

Hi Aparna,

You can attempt to fix this by using /usr/sbin/acct/fwtmp.

The files can be viewed with:

# cat /var/adm/wtmp | /usr/sbin/acct/fwtmp
# cat /etc/utmp | /usr/sbin/acct/fwtmp

If you want to attempt to fix the files, use the following steps to manually
correct /etc/utmp:

1. Extract the ASCII version of the utmp file:
# /usr/sbin/acct/fwtmp < /etc/utmp >/tmp/utmpa

2. Edit the ASCII verion of vi and remove the incorrect entry or entries:
# vi /tmp/utmpa

3. Replace /etc/utmp with the corrected version:
# /usr/sbin/acct/fwtmp -ic < /tmp/utmpa > /etc/utmp

The same procedure will work with /var/adm/wtmp, specifying a temporary copy
in /tmp/wtmpa.

Regards,
Robert-Jan.

[G. Vrijhoeven]

Hi,

Clean the files >btmp && >wtmp
also check /etc/utmp ( try logging in with telnet, or ssh )
Do you have accountnames availible on the server, that exceed 8 characters?

The btmp wtmp and utmp files have only so many characters reserved for names etc.

Gideon

Gideon

[john korterman]

Hi,
I think the proper way of setting these files to zero is by catting dev/null to them, e.g.:
# cat /dev/null >/var/adm/btmp

An alternative is to use SAM for triming these files: SAM->Routine Tasks->System Log Files; I think SAM does it with the cat /dev/null.

regards,
John K.

[aparna challagulla]

hi all,

Thank you all for the quick replies.
I copied the old contents and cleaned up these files.
I will try to fix the backup file later. thx Robert.
hi Vrijhoeven,
no we do not have login names exceeding 8 characters.

cheers
aparna