Getting core dump when running last command.

[John Goetz]

# last
Memory fault(coredump)

Does this pertain to wtmp and how can I fix this file?

[Deoncia Grayson_1]

can you read the core dump file? If so, can you post it?

[John Goetz]

# strings core
glbsrv3
B.11.00
9000/800
1154454620
last
@pts/
0s.co
cms-cgis?
Q1UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
{le_?
pts/
$Revision: 92453-07 linker linker crt0.o B.10.60 970821 $
/usr/lib/dld.sl
ERROR: mmap failed for dld
ERROR: mmap failed for TSD
@(#) $Revision: 82.1 $
/dev
/dev/pty
[ -number ] [ -f file] [ -R ] [ name ... ] [ tty ... ]
lastb
/var/adm/btmp
/var/adm/wtmp
%-*.*s %-*.*s %-*.*s %10.10s %5.5s
%-*.*s %-*.*s %10.10s %5.5s
still logged in
- %s
- %5.5s
(%5.5s)
(%ld+%5.5s)
reboot
shutdown
down
crash
wtmp begins %10.10s %5.5s
btmp begins %10.10s %5.5s
interrupted %10.10s %5.5s
reboot
'%c': unknown option
usage: %s
4{
0d{
/var/adm/wtmp
LOGIN
pts/ta
e02k208.corp.mot
LOGIN
pts/ta
LOGIN
pts/ta
e02k208.corp.mot
LOGIN
pts/ta
LOGIN
pts/ta
e02k208.corp.mot
LOGIN
pts/ta
LOGIN
pts/ta
e02k208.corp.mot
LOGIN
pts/ta
LOGIN
pts/ta
Ee02k208.corp.mot
LOGIN
pts/ta
LOGIN
pts/ta
]e02k208.corp.mot
LOGIN
pts/ta
LOGIN
pts/ta
e02k208.corp.mot
LOGIN
pts/ta
LOGIN
pts/ta
e02k208.corp.mot
LOGIN
pts/ta
LOGIN
pts/ta
e02k208.corp.mot
LOGIN
pts/ta
LOGIN
pts/ta
&sol8-login0.cig.
!oracle
pts/ta
+sol8-login0.cig.
!oracle
pts/ta
LOGIN
pts/ta
sol8-login1.cig.
Uoracle
pts/ta
sol8-login1.cig.
Uoracle
pts/ta
root
pts/tb
root
pty/ttyp1
e02k208.corp.mot
HLOGIN
pts/ta
sol8-login1.cig.
Uoracle
pts/ta
sol8-login1.cig.
Uoracle
pts/ta
LOGIN
pts/ta
sol8-login0.cig.
!oracle
pts/ta
sol8-login0.cig.
!root
pty/ttyp1
e02k208.corp.mot
HLOGIN
pts/tb
e02k208.corp.mot
oracle
pts/tb
e02k208.corp.mot
oracle
pts/ta
LOGIN
pts/ta
sol8-login1.cig.
ULOGIN
pts/ta
LOGIN
pts/ta
e02k208.corp.mot
oracle
pts/ta
e02k208.corp.mot
oracle
pts/ta
LOGIN
pts/ta
Ie02k208.corp.mot
oracle
pts/ta
Ne02k208.corp.mot
oracle
pts/ta
LOGIN
pts/ta
cms-cgiss.corp.m
B2root
pts/ta
cms-cgiss.corp.m
OGp{
4{
4{
! {
)L{
*d{
/({
0L{
0d{
4t{
:l{
=L{
@h{
Cp{
E0{
H\{
L,{
O4{
T8{
XH{
X`{
]P{
` {
`8{
d|{
h4{
hL{
ix{
!'T{
!(x{
4!2i
/usr/lib/libdld.2
OGp{
q${
$Header: U_qfcpy.s,v 66.1 90/07/13 12:21:03 pratap Exp $
HP Proprietary
$Header: U_qfabs.s,v 66.1 90/07/13 12:12:17 pratap Exp $
HP Proprietary
PATH=/usr/bin
/usr/bin/sh
getopt_lib
/etc/utmp
dbm: no open database
@(#) $ PATCH/11.00:PHCO_29633 Sep 26 2003 06:07:40 $
unspecified
/etc/utmpx
Qank
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNO
PQRSTUVWXYZ{|}~
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmno
pqrstuvwxyz{|}~
/dev/telnet
/dev/
/dev/
/dev/console
cEx]
k:v@
z`wE
w$p)~
YQa@
/dev/
/dev/
0123456789abcdef
0123456789ABCDEF
%s%s: %s
%s: %s%s
%s: %s: %s
/dev/console
k:v@
z`wE
w$p)~
YQa@
IFS=
/dev
%s%s
%s%s
%s%s%s
%s%s%s
4!=A
/usr/lib/libc.2
4!91
/usr/lib/libc.2
/opt/graphics/OpenGL/lib/libogltls.sl
@(#) SMART_BIND
@(#)92453-07 dld dld dld.sl B.11.38 031218
last
_=/usr/bin/last
MANPATH=/usr/share/man/%L:/usr/share/man:/usr/contrib/man/%L:/usr/contrib/man:/u
sr/local/man/%L:/usr/local/man:/opt/upgrade/share/man/%L:/opt/upgrade/share/man:
/usr/dt/share/man:/opt/pd/share/man/%L:/opt/pd/share/man:/opt/hparray/share/man/
%L:/opt/hparray/share/man:/opt/ignite/share/man/%L:/opt/ignite/share/man:/opt/au
dio/share/man:/opt/ansic/share/man/%L:/opt/ansic/share/man:/opt/langtools/share/
man/%L:/opt/langtools/share/man:/opt/cxperf/share/man:/opt/fortran90/share/man/%
L:/opt/fortran90/share/man:/opt/fortran90/contrib/man:/opt/imake/man:/opt/perf/m
an/%L:/opt/perf/man:/opt/OV/man/itose/%L:/opt/OV/man/itose:/opt/aCC/share/man/%L
:/opt/aCC/share/man:/opt/graphics/common/man:/opt/EMCpower/share:/opt/hpnpl//man
PATH=/usr/sbin:/usr/bin:/opt/ansic/bin:/usr/ccs/bin:/usr/contrib/bin:/opt/nettla
dm/bin:/opt/fc/bin:/opt/fcms/bin:/opt/upgrade/bin:/opt/pd/bin:/usr/bin/X11:/usr/
contrib/bin/X11:/opt/hparray/bin:/opt/cxperf/bin:/opt/langtools/bin:/opt/fortran
90/bin:/opt/fortran90/contrib/bin:/opt/imake/bin:/opt/perf/bin:/opt/OV/bin/OpC:/
opt/ignite/bin:/opt/aCC/bin:/opt/graphics/common/bin:/opt/hpnpl//bin:/sbin:/home
/root:/usr/storapi/bin
EDITOR=vi
HISTFILE=/.sh_history
LOGNAME=root
MAIL=/var/mail/root
ERASE=^H
SHELL=/sbin/sh
HISTSIZE=2000
HOME=/
TERM=vt100
PWD=/
TZ=CST6CDT
UUUUUUUUUUUUUUUU
0s.co
4454{
|ltD
|l|D
n b{
root @ glbsrv3 [/]
#

[Pete Randall · Accepted solution]

Probably the wtmp file is corrupt. Try saving it first then re-creating it:

mv /etc/wtmp /etc/wtmp.sav
cat /dev/null > /etc/wtmp
last

If the last command works, the the wtmp file was definitely corrupt. If not, you can move the original back into place and start searching for a patch.


Pete

[H.Merijn Brand (procura]

Did the wtmp file grow over 2 Gb?

Enjoy, Have FUN! H.Merijn

[OldSchool]

I ran into the same problem some time ago.

What I do now is run a script weekly in cron to zero length the wtmp a btmp files.

#!/bin/sh
# Cron Entry
#05 00 * * 0 /usr/sbin/clean.logins # Purge Login Files every Sunday
# This Script Clears Login Files Weekly
#
cd /var/adm/
cp /dev/null wtmp
cp /dev/null btmp
exit


These files will get quite large and I need only maitain one week worth of login data.

Hope this helps,

Tom

[H.Merijn Brand (procura]

But by doing so you also remove (what I think is) valuable information, like the boot time.

I use this Perl script to clean up all but the relevant info

--8<---
#!/pro/bin/perl

use strict;
use warnings;
use User::Utmp;
use Data::Dumper;

my ($n, $s, $treshold, @wtmp, %type) = (0, 0, time - 7 * 24 * 60 * 60);
User::Utmp::utmpname (shift || "wtmp");
User::Utmp::setutent ();
while (my @entry = User::Utmp::getut1 ()) {
++$n % 100 or printf STDERR " %6d %6d\r", $n, $s;
#print Dumper \@entry;
#$type{$entry[0]->{ut_type}}++;
if ( $entry[0]->{ut_type} == LOGIN_PROCESS &&
$entry[0]->{ut_time} > 0 && $entry[0]->{ut_time} < $treshold) {
$s++;
next;
}
push @wtmp, @entry;
}
User::Utmp::endutent ();

print STDERR "wtmp has $n entries, I skipped $s\n";
#print STDERR "[ ", (join ", ", map { "$_ => $type{$_}" } sort { $a <=> $b } keys %type), " ]\n";

User::Utmp::utmpname ("/tmp/wtmp");
User::Utmp::putut ($_) for @wtmp;
User::Utmp::endutent ();
-->8---

and run it like this

--8<---
#!/usr/bin/sh

cd /var/adm
/var/adm/bin/clrwtmp.pl wtmp
mv /tmp/wtmp .
-->8---

Enjoy, Have FUN! H.Merijn

[H.Merijn Brand (procura]

Here's the C version:

--8<--- clrwtmp.c
#include
#include
#include
#include
#include
#include

#define UTMPSZ (sizeof (struct utmp))

int main (argc, argv)
int argc;
char *argv[];
{
auto struct utmp buf;
register struct utmp *u = &buf;
register int i, w = 0, o = 1, x;
register long sv_time = 0L;
register size_t s = UTMPSZ;

if (argc == 2 && strcmp (argv[1], "-?") == 0) {
(void)printf ("usage: clrwtmp [days] [in [out]]\n");
return (0);
}

for (i = 1; i < argc; i++) {
if (!sv_time && isdigit (*argv[i])) {
sv_time = time (0) - atoi (argv[i]) * 86400;
continue;
}
if (w == 0 && (x = open (argv[i], O_RDONLY)) > 0) {
w = x;
continue;
}
if (o == 1 && (x = open (argv[i], O_WRONLY | O_TRUNC | O_CREAT, 0666)) > 0) {
o = x;
continue;
}
}
if (!sv_time)
sv_time = time (0) - 2764800; /* Save last 32 days */

while (read (w, u, s)) {
if (u->ut_time >= sv_time)
write (o, u, s);
}
return (0);
} /* main */
-->8---

# mkdir /var/adm/bin
# cc -O -s -o /var/adm/bin/clrwtmp clrwtmp.c

--8<--- clrwtmp.sh
#!/usr/bin/sh

cd /var/adm
/var/adm/bin/clrwtmp 8 wtmp /tmp/wtmp
mv /tmp/wtmp .
-->8---

Enjoy, Have FUN! H.Merijn