heaps of core files from last command

[support_5]

Hi Folks,

I am getting an unusually high number of corrupted wtmp/btmp files on my systems. So much so that I have to clear these files daily to try and reduce the number of core files left laying around from the last command.

So I'm rotating the binary log files daily, to clear out any corruption, but I'm still finding that on average 15% of my servers will have a corrupted wtmp/btmp file by the middle of the day, and then leave dozens of core files around the filesystem until the btmp and wtmp files get rotated the following evening.

Can anyone shed any light on why this might be the case, and how to resolve it?

I'm suspecting it might be something to do with ssh, as the increased usage of ssh (as opposed to rlogin) has risen sharply in the last few months as a result of a push from us admins to get users using ssh instead of rlogin, and this increase corresponds with the increased number of core files.

Help is appreciated. Thanks.

- Andrew

[Ravi_8]

Hi,

can you post the log file (/var/adm/syslog.log) line containing wtmp/btmp patterns.

also the version of ssh you have installed.

Try installing latest ssh

[support_5]

Hi,

I am not sure what you mean by the lines in syslog.log. Syslog.log doesn't mention anything to do with last or wtmp.

I am using the HP provided ssh. ie T1471AA version A.03.81.002, which corresponds to OpenSSH 3.8 and openSSL 0.9.7d

about a month or so ago I had also upgraded ssh from 3.6, but we were already getting lots of core files even before I had upgraded.

Can you elaborate on the information you want to see?

Thanks.

- Andrew