last command says I am still logged in

[Ratzie]

I posted a question regarding a bad last command. And I thought I had it working but now I have additional problems.
When I log out last still says I am logged in!

I made the mistake of clearing out the wtmp file utmp file.
>wtmp
>wtmp

Now I am running into problems with the last command.
It still says I am logged in when I am not.

# who
laura pts/0 Dec 10 11:29
laura pts/1 Dec 10 11:52

# last
laura pts/1 Wed Dec 10 11:52 still logged in
laura pts/1 Wed Dec 10 11:47 still logged in

wtmp begins Wed Dec 10 11:47

****Logged out***

# who
laura pts/0 Dec 10 11:29
# last
laura pts/1 Wed Dec 10 11:52 still logged in
laura pts/1 Wed Dec 10 11:47 still logged in

wtmp begins Wed Dec 10 11:47
# last
laura pts/1 Wed Dec 10 11:52 still logged in
laura pts/1 Wed Dec 10 11:47 still logged in

wtmp begins Wed Dec 10 11:47

Completely logged out of server and logged back in...

$ last
laura pts/0 Wed Dec 10 11:55 still logged in
laura pts/1 Wed Dec 10 11:52 still logged in
laura pts/1 Wed Dec 10 11:47 still logged in

wtmp begins Wed Dec 10 11:47


I went in and trimmed using sam, same problem.
I also did I reboot. That would clear the still logged in but I still have the same problem!

[Steven E. Protter]

Probably the user was logging in while you were clearing the file.

Seems strange whats going on.

Perhaps you need to check permissions on the wtmp file and completely delete it and rebuild it.

SEP

[Sanjay_6]

Hi,

did you try a cat /dev/null > /var/adm/wtmp

This will clean all the info.

Hope this helps.

Regds

[RAC_1]

Doing >/var/adm/wtmp would not cause problem.

Also check if you are up to date on WTMP patches.

Also look at fwtmp command.

[Ratzie]

Do I need to be at the console when I cleared this file?
I am the only one on the system. I am still at a loss!

[Sanjay_6]

Hi,

You can trim the file to an acceptable size if you do not want to trim it to zero.

Take a look at this thread,

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000063200530

The doc id is KBRC00002527

Hope this helps.

Regds

[RAC_1]

You need not be on console for doing this.

Post ll /var/adm/wtmp.

(I assume you doing all this by loggin in as root user)

[Pete Randall]

Laura,

Here's what I get:


# >/var/adm/wtmp
# exit
$ last

wtmp begins Wed Dec 10 13:23
$ ll /var/adm/wtmp
-rw-rw-r-- 1 adm adm 0 Dec 10 13:23 /var/adm/wtmp
$



I had logged in as myself, su'd to root, and cleared the wtmp file. As you can see, it shows zero bytes and the last command returns nothing. Are you sure this is what you're doing?


Pete

[Helen French]

You don't need to be in the console. From any telnet session:

# cd /var/adm
# > wtmp

Also, check for all latest patches for last command.

[Sanjay_6]

Hi,

You don't have to be on the console to do this. you can do this from any telnet session itself.

Hope this helps.

Regds

[Ratzie]

Yes that is what I did!

$ last
lhradowy pts/0 Wed Dec 10 12:26 still logged in
lhradowy pts/0 Wed Dec 10 12:26 still logged in

wtmp begins Wed Dec 10 12:25
$ ll /var/adm/wtmp
-rw-rw-r-- 1 adm adm 240 Dec 10 12:26 /var/adm/wtmp
$


I also did cat /dev/null > /var/adm/wtmp

Still same problem...
I will look for patch...

[RAC_1]

How abt this?

fwtmp < /var/adm/wtmp > /tmp/login.txt
>/tmp/login.txt
fwtmp -ic < /tmp/login.txt > /var/adm/fwtmp

>/var/adm/fwtmp

$last

Post the results.

[Paula J Frazer-Campbell]

Laura

$ last
lhradowy pts/0 Wed Dec 10 12:26 still logged in
lhradowy pts/0 Wed Dec 10 12:26 still logged in


Times are the same? check your profile what is it doing?

Also having a second root level login is a security issue - it provides another superuser entrance - best to have only one root level user "root" and only use it as a last resort. Su to root if required from your normal working login.

Paula

[Ratzie]

SAME PROBLEM!

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/login.txt
# >/tmp/login.txt
# /usr/sbin/acct/fwtmp -ic /var/adm/wtmp
# date
Wed Dec 10 12:40:32 CST 2003
# >/var/adm/wtmp
# last

wtmp begins Wed Dec 10 12:40
# date
Wed Dec 10 12:40:58 CST 2003
# last
lhradowy pts/2 Wed Dec 10 12:41 still logged in
lhradowy pts/1 Wed Dec 10 12:41 still logged in

wtmp begins Wed Dec 10 12:41

[Sanjay_6]

Hi,

Yes this is possible. Your profile might be calling a new shell within the profile.

Hope this helps.

Regds

[Ratzie]

I am trying to be as secure as possible.
I do not want second level user login.

How did I do that!

[Ratzie]

I have default profiles set up! I have not touch the profiles at all.

I did mv roots profile to /rootuser...

[RAC_1]

> /etc/utmp

Post

[Geoff Wild]

As RAC says - try it on utmp.

You might have to clean bad logins as well:

>/var/adm/btmp

Rgds...Geoff

[Ratzie]

Wed Dec 10 13:19:59 CST 2003
Still problem!
I can't find any patches regarding this as well.

# >/etc/wtmp
# last

wtmp begins Wed Dec 10 13:20
# last
lhradowy pts/1 Wed Dec 10 13:20 still logged in

wtmp begins Wed Dec 10 13:20
# last
lhradowy pts/1 Wed Dec 10 13:20 still logged in

wtmp begins Wed Dec 10 13:20

[Ratzie]

btmp does not work as well...
lastb
shows the current date! And does not log bad logins!

And yes I recreated it and still no go!

# date
Wed Dec 10 13:43:39 CST 2003
# lastb

btmp begins Wed Dec 10 13:43

[Jdamian]

How do you log into the system ?

telnet ? Open-ssh ?

[Ratzie]

I have shut off all telnet r* related services. I am strictly runing ssh

[Geoff Wild]

I think it's time to place a Support call with HP....

Let us know how it was resolved.

Rgds...Geoff

[Ratzie]

I have spent endless hours trying to fix it, and I have duplicated it on another machine, so it is a bug problem...

Now, does HP have a link to address bug problems.... NO!

I was transfered 10 times before I found someone to talk to.

I have a case in with them.