PHNE_24829 and /etc/utmp

[Krejci]

Is this patch usable to resolv problem with /etc/utmp and bad login records ?

[Clemens van Everdingen]

Hi,

Could be so, but is depending on your utmp problem.

C.

[Pete Randall]

Read the Special Installation Instructions.

I'll quote:

Special Installation Instructions:
PHNE_24829 contains a fix for the telnetd code defect
described in SR: 8606220839 (JAGad89975) - telnetd writes
to the wrong entry in /etc/utmpx on logout.

Although the SR: 8606220839 (JAGad89975) fix will prevent
any further corruption of /etc/utmpx(4), installing
PHNE_24829 will not correct any existing corruption in the
/etc/utmp(4) or /etc/utmpx(4) files.

Therefore if you are installing PHNE_24829 to fix the SR:
8606220839 (JAGad89975) defect, to completely resolve the
problem you must also ensure that the /etc/utmp and
/etc/utmpx files are cleared of any previous corruption
caused by this defect.

The /etc/utmp and /etc/utmpx files may be cleared using the
following procedure:

Before installing PHNE_24829 insert two lines into the
/etc/inittab(4) file as follows, then save /etc/inittab and
continue the PHNE_24829 patch installation.

init:3:initdefault:
utm1::sysinit:> /etc/utmp # clear current logon accounting files
utm2::sysinit:> /etc/utmpx # clear current login accounting files

After PHNE_24829 is installed and the system rebooted, you
may delete the above two entries from /etc/inittab or retain
them. In the latter case, /etc/utmp and /etc/utmpx will be
cleared every time the system is rebooted.

NOTE: The above steps are only required if the problem
described in SR: 8606220839 (JAGad89975) exists on
the system where PHNE_24829 is being installed.



If that relates to your utmp problem, then this is the patch for you. Follow the directions.

Pete

[Krejci]

The command "who am I" returns 2 lines for some users, in spite off I have intalled patch and cleaned file /etc/utmp.


Rudo

[Clemens van Everdingen]

Hi,

Have you cleaned the file wtmp as well ?

C.

[Krejci]

We have updated our system from HPUX 11.00 to 11.11. In previous version we haven`t this problem.

[Bill Hassell]

utmp is always re-created during reboot while wtmp is cumulative. NOTE: wtmp *cannot* be more than 1 year old or you will get duplicate records. wtmp does not keep the year so if a user logged in more than a year ago, the 'last' command will show all the entries. Be sure to process and clear the wtmp file every few months.

utmp can be written by any process so there is always the possibility that a badly written program is causing bad login records. But most likely, the cause can be traced to trashed connections caused by PCs that crash or users that don't close applications properly. This is why a lot of applications are switching the user interface to a client-server model where the application controls the protocol and a trashed connection is handled gracefully.

[Krejci]

It is 12 hours without bad record in utmp already after cleaning /etc/utmpx, /etc/utmp and /etc/wtmp


Thanks all for help.