last doesn't work, and cat /dev/null > /var/adm/wtmp not fix this problem!

[Andrey Zhelnin]

Hello!
HP-UX 11.23.
My last show only ftp logins, but in wtmp I saw
other logins.
cat /dev/null > /var/adm/wtmp
and
cat /dev/null > /var/adm/wtmps
not fix it - whith new files last work just as before.
Please, help me!

[Steven E. Protter]

Shalom

> /var/adm/wtmp
> /var/adm/wtmps

This will empty them but leave them in place with permissions.

inetd -l should start enhanced logging.

SEP

[Arunvijai_4]

Hello,

This thread should help you.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=990722

-Arun

[RAC_1]

There is fwtmpfix and fwtmp command.
Did you use it??

[Andrey Zhelnin]

Thank you all,
but not for a while yet nothing help me:((

to Steven E Protter -
I clear both files, how You write -
> /var/adm/wtmp
> /var/adm/wtmps
and they will be zero size. Then, when users login, situation was repeat -
1) in wtmps - only ftp logins
2) in wtmp - other logins
but last command show only logins from wtmps!
lastb work properly.

to Arunvijai
- I alredy read this thread, but main idea of it - properly clear wtmp, I do it, but nothing changes...

to RAC
I don't understood, how work whith this command :((
/usr/sbin/acct/wtmpfix < /var/adm/wtmp
Invalid input. Exiting ...

[Arunvijai_4]

Hello,

/usr/sbin/acct/wtmpfix < /var/adm/wtmp
works for me.. # man wtmpfix will help you.

-Arun

[Devender Khatana]

Hi,

You should truncate both "/var/adm/wtmps" & "/var/adm/btmps" files (AND NOT /var/adm/wtmp & /var/adm/btmp ) as your OS is 11.23 and not 11 or 11i.

These has been the small chages in OS revisions which we always forget at times.

HTH,
Devender

[Andrey Zhelnin]

Last not work, but
/usr/sbin/acct/fwtmp < /var/adm/wtmp
show me all logins not ftp.
Because I don't know, how do last work properly, I'll use
/usr/sbin/acct/fwtmp < /var/adm/wtmp

But I hope, may be anybody know, how do this?..

Thank You all,

Vera.
P.S. I very bad know english - understand, when I read, but not speak and very bad write, sorry.

[VAS_1]

Does this command give you the output you expect?

last -f /var/adm/wtmp

What is being used to log in to the machine (ssh, telnet?)

VAS

[Geoff Wild]

Do you have a /etc/utmp ?

Maybe that is corrupt as well....

Rgds...Geoff

[Andrey Zhelnin]

Thank you all!

/etc/utmp - is not corrupt,
last -f /etc/utmp
is work properly.

and
last -R -f /var/adm/wtmp
is work properly.

Now, I don't understand only why "last" without arguments not show information from all this files...

[Muthukumar_5]

last command will use /var/adm/wtmp contents if you did not give -f option.

Can you try as,

mv /var/adm/wtmp /var/adm/wtmp.old

Post this output,

last
last -f /var/adm/wtmp

--
Muthu