restore wtmp file to view

[Coolmar]

Hi,

I have restored an old wtmp file to another directory because we have to view it. I used the following command to view it and got this error. Is there something I am missing? Do I have to restore more than that file?

last -R -f /home/name/restore/var/adm/wtmp
pid exceeds MAXPID: wtmp file corrupted

[Jeff Schussele]

Hi Sally,

fwtmp is your huckleberry.
It'll write an ASCII file that you can view with any editor.

HTH,
Jeff

[Pete Randall]

"huckleberry"???

Never heard that one, Schuss. Midwestern slang?


Pete

[Coolmar]

I tried this:

/usr/sbin/acct/wtmpfix /home/pf10396/restore/var/adm/wtmp
Bad file at offset 2117280
pts/ta 942946352 Thu Nov 18 11:32:32 1999

[Coolmar]

I did the following with fwtmp and got:

cat /home/name/restore/var/adm/wtmp | /usr/sbin/acct/fwtmp


The first half of the file was fine and the rest was all full of ascii chars.

[Patrick Wallek]

I'm not entirely surprised that cat didn't work well since wtmp is a binary file.

Try this instead:

# fwtmp < /home/name/restore/var/adm/wtmp > /home/name/restore/var/adm/wtmp.ascii

and see if you have any better luck.

[Jeff Schussele]

Patrick,

What???
Never seen Tombstone?
The seen where Doc Holliday intervenes in Wyatt's gunplay with Ringo???
And yes, it's kinda MW slang....just because huckleberrys are SO good, but they only grow above 3K feet - which kinda rules us out.
So we have to import 'em from the Rockies.

OK - my lesson's done,
Jeff

[Coolmar]

Thanks patrick but same result. It starts out great and then just prints ascii chars all over the place. I wonder if the file is corrupt?

[Jeff Schussele]

Wow.....need more COFFEE!!!!
seen != scene
Tells me just what part of my brain I type from &~))

Embarrasingly,
Jeff

[Kent Ostby]

Sally -- fwtmp is your best bet. If that's not working I don't think you're probably going to be able to get anything.

***********************************

Pete... the line is when Ringo is looking for someone to pick a fight with:

Ringo: Wretched slugs, don't any of you have the guts to play for blood?
Doc: I'm your huckleberry.

You can even hear him say it here:
http://www.moviesoundscentral.com/sounds/tombstone/huckleberry.wav

[James R. Ferguson · Accepted solution]

Hi Sally:

Corruption of a 'wtmp' file does occur. If you are of that opinion, your best recourse is to convert the binary 'wtmp' file to ASCII with 'fwtmp' as has already been suggested. If you encounter a clearly bad record, disregard and/or delete it.

This is the technique needed if you want to fix and restore a corrupt 'wtmp' (or 'btmp') file:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

...edit...

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

Regards!

...JRF...