HPUX 11.31 IA64, wtmp not getting updated..

[sadat]

Hi,

Whne i login on the HPUX1131 system record is added to the "/var/adm/wtmp" file, but when i run the command to see the data ..
cat /var/adm/wtmp | /usr/sbin/acct/fwtmp

I get the following output

root 2 pts/2 18944 7 0000 0000 0 Jan 1 05:30:00 1970 46.105.110.100

Instead of "Jan 1 05:30:00 1970" as seen above, i`am expecting the date on which the user last logged in.
What might be the issue?
Thanks.

[Dennis Handly]

I assume you are looking at the end of the output? The line with 1970 probably indicates the date wasn't set.
Have you read utmpd(1M)?

[Kapil Jha]

Can you please check and post permission of wtmp
for me its
/var/adm> ls -lrt|grep wtmp
-rw-rw-r-- 1 adm adm 22440 Apr 30 23:48 wtmp
-rw-r--r-- 1 root root 1086400 Apr 30 23:48 wtmpx

.What does "last" command says.
BR,
Kapil

[sadat]

-rw-rw-r-- 1 adm adm 597884 May 25 23:25 wtmps
-rw-r--r-- 1 adm adm 288 May 25 23:25 wtmp

One more strange thing is the data is somewhat strange after i login and logout for 3/4 times..
0 pts/0 18897 8 0000 0000 0 Jan 1 05:30:00 1970
root 1886679855 12288 0000 0000 21227 Jan 1 11:23:47 1970 72.57.167.231
H9¨ 0 0 0000 0000 1919905652 Nov 3 08:37:32 2030


I read the man for utmpd, but not sure whether this is related to wtmp.


Thanks.

[Dennis Handly]

>One more strange thing is the data is somewhat strange

This file looks hopelessly corrupted. You should scratch it and use the wtmps file instead:
/usr/sbin/acct/fwtmp -X < /var/adm/wtmps

>I read the man for utmpd, but not sure whether this is related to wtmp.

It creates both but there is a delay but obviously not since 1970. :-)

[sadat]

Dennis,

Thanks. The command mentioned by you returns proper results.
I deleted all the entries in "/var/adm/wtmp", but the new entries are again not added correctly. What might be the issue here?

[sadat]

I mean, why is the file "/var/adm/wtmp" getting corrupted?

[Dennis Handly]

>I deleted all the entries in "/var/adm/wtmp", but the new entries are again not added correctly. why is the file "/var/adm/wtmp" getting corrupted?

Is it because /etc/utmp is bad?

You man have to stop utmpd then erase wtmp then restart?