last command shows the user even though user has logged out

[maheswaran]

The "last" command which show the last users being logged into the server is showing users still logged in while there are not.could you pls anyone update me whether any fix is avaliable to solve this time.

[A. Clay Stephenson]

Last and who should be thought of as the system's "best guess" because they are based upon utmp and wtmp entries. You can use the fwtmp andor wtmpfix to repair the files. In the case of fwtmp you read the file out in ASCII format, edit it, and read your ASCII file to recreate the binary file. Man fwtmp for deatils.

I consider this pretty much a waste of time because using who/last to determine users on the systems is not very reliable --- and this applies to all flavors of UNIX. The process table (ps) is really the reliable method.

[skt_skt]

Try this way if at all you want to try the fix.Keep in mind that the month end is near; You may try this later eevn though this is a tested procedure

1. Ensure that the wtmp file is not corrupt by running a last on your user id:

# last ` who am i `

2. Convert the wtmp file to ascii into a file system that has sufficient space:

# cat /var/adm/wtmp | /usr/sbin/acct/fwtmp > /tmp/ascii_wtmp

3. Determine the number of lines in the ascii file, take 10% of that value, and subtract that from total number of lines:

# lines=`cat /tmp/ascii_wtmp | wc -l`;lines2=`expr $lines / 10`; export lines3=`expr $lines - $lines2`;echo $lines3

4. Start the ascii file from the line number given as output from the above command:

# awk ' ( NR > '$lines3' ) ' /tmp/ascii_wtmp > /tmp/ascii_wtmp2

5. Convert the trimmed ascii file back to binary in place of the original wtmp:

# cat /tmp/ascii_wtmp2 | /usr/sbin/acct/fwtmp -ic > /var/adm/wtmp

6. Verify that the operation was successful

# ll /var/adm/wtmp

# last ` who am i `

[Steven E. Protter]

Shalom,

As noted who and derivitives are m much better.

Note that if you never trim your wtmp file, it can get bit and make the chances of a false reading like this go up.

SEP

[whiteknight]

Hi Maheswaran,

You may backup the btmp and wtmp files so you would have the login information
and then remove these files from the system. It is recommended to first see
how fast the files grow, and then schedule a cron job to backup and trim the
files.

wtmp and btmp can be zeroed out using the following:

cat /dev/null > /var/adm/wtmp
cat /dev/null > /var/adm/btmp

Rather than using the commands: rm, touch, chmod, chown, chgrp in order to
create an empty file, the cat /dev/null technique retains all the
characteristics of the old file. Note that zeroing /var/adm/wtmp on a running
system may cause errors to be reported from the who command. These
errors are caused by who not finding the users currently logged in.
The best way to trim /var/adm/wtmp is to do it in single user mode. Do not
zero the /etc/utmp...this is done automatically.

or
You can also use
SAM -> Routine Tasks -> System Log Files
to trim wtmp, btmp and other log files.


WK
please assign points

[MarkSyder]

If you like shortcuts:

> /var/adm/wtmp

does exactly the same as cp /dev/null etc.

Mark Syder (like the drink but spelt different)