last command error

[V. V. Ravi Kumar_1]

hi all,

iam getting the following error when i issue the last command. but lastb working fine. wtmp file exists in /var/adm. what could be the reason. it is hp-ux 11.0 system.

Memory fault(corddump)

thanks in advance
ravi

[Jeff Schussele]

Hi Ravi,

Suspect the wtmp file is corrupt.
last checks it whereas lastb checks the btmp file.

HTH,
Jeff

[Shahul]

Hi

Please check up the permission and owner of /var/adm/wtmp file.


It should be 664 adm adm. If still problem follow this

#cd /var/adm
#cp wtmp wtmp.org
#>wtmp
#last

Now U see whether it is giving any error or not.. If still problem , then something wrong with /usr/bin/last command.

Best of luck
Shahul

[S.K. Chan]

The "last" command query /var/adm/wtmp while "lastb" query /var/adm/btmp. So if you're getting core dump on "last", most probably /var/adm/wtmp is corrupted.

Do this ..
# cd /var/adm
# mv wtmp wtmp.old
# touch wtmp
==> retain the same permission/ownership as wtmp.old
# last

If it's ok, then it's confirmed "wtmp" is corrupted.

[MANOJ SRIVASTAVA]

Hi Ravi


The wtmp file is corrupt , please recreate it using :

to read wtmp file, that now seems to be corrupted ,do like this:

the following will convert it to ASCII file
#/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/file
then you can either edit the file or read it.

Then you can convert it back to binary form:
##/usr/sbin/acct/fwtmp -ic < /tmp/file > /var/adm/wtmp


Manoj Srivastava

[V. V. Ravi Kumar_1]

thank u all
regds
ravi

[Nick Wickens]

When I had corruption in the wtmp file the corruption was always indicated by 1970 date stamps and I had to use /usr/lib/acct/wtmpfix < /etc/wtmp > wtmpfix.new to fix the time stamps - see man page for wtmpfix

[Helen French]

A better explanation from here (TKB #KBRC00001970):

http://support2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000058668889