"last" command dumps core - HP-UX 11.00

[Brian Williams_5]

How do I fix this problem?!

# whoami
root

# uname -a
HP-UX pokie B.11.00 U 9000/800 1514750538 unlimited-user license

# last
Memory fault(coredump)

# file core
core: core file from 'last' - received SIGSEGV

[harry d brown jr]

If it used to work, and now it is failing then either your btmp or wtmp file is corrupt.

[James R. Ferguson · Accepted solution]

Hi Brian:

This should fix your problem:

# cat /dev/null > /var/adm/wtmp

Regards!

...JRF...

[Brian Williams_5]

Hi Harry,

I have both files:

# ls -altr /var/adm/btmp
-rw------- 1 root other 4500 Oct 18 13:12 /var/adm/btmp
# ls -altr /var/adm/wtmp
-rw-rw-r-- 1 adm adm 161336 Oct 18 13:59 /var/adm/wtmp

How do I tell which is corrupted?

Thanks,
/ Brian

[linuxfan]

Hi Brian,


last command gets its information from wtmp file where as lastb gets it from btmp.

In your case looks like wtmp is corrupted.

you could try "cat /dev/null > /var/adm/wtmp"

-HTH
Ramesh

[Brian Williams_5]

Yes, "last" was working before and then mysteriously stopped. I *think* it was after I used sam to change some kernel parameters (maxdsiz, etc.) that it stopped working.

But the "cat /dev/null > /var/adm/wtmp" command fixed this problem. Thanks.

[James R. Ferguson]

Hi Brian:

One more trick. If you ever need/want to preserve your 'wtmp' and/or 'btmp' file, but it is corrupted, or you simply want to trim it, then you can "edit" it like this:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

At this point, you may edit the /tmp/wtmp file, since it is a ASCII file.

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

Regards!

...JRF...

[Roger Baptiste]

Brian,

You can use /usr/sbin/acct/wtmpfix command
to try fixing the corrupt
wtmp file. If it doesn't
work you can preserve
the ascii version of the file
by running fwtmp .

-raj