The last(1) command does not show login

[Thomas Stuetzer]

Hello,
the last command doesn'z work, but the who and lastb command work fine.
The login is a telnet session (Not CDE)

the last command shor the last entry from 23.12.2005
>last |more
root pts/tb Tue Dec 23 12:23 - 12:23 (00:00)
konadm remshd Mon Dec 22 17:30 - 17:53 (00:23)

the who command works
>who
root pts/0 Jan 11 14:55
stuetzet pts/1 Jan 11 15:04
root pts/ta Jan 11 15:25

and also the lastb and finger command
>lastb |more
root pts/ta Wed Jan 11 15:25
ddd pts/ta Wed Jan 11 15:25
stuetzet pts/0 Wed Jan 11 14:54
root pts/tc Fri Dec 16 15:59

list contents of directory
>/var/adm#ls -al ?tmp*
-rw------- 1 root other 13860 Jan 11 15:25 btmp
-rw-rw-r-- 1 adm adm 995472 Jan 11 15:38 wtmp
-rw-r--r-- 1 root root 280 Jan 1 01:00 wtmpx

Any ideas are welcome.
Thanks an advance!

[Peter Godron]

Thomas,
was the login via su ?

[Thomas Stuetzer]

Hello Peter,
the login was a telnet session, not via su.
Thomas

[Jeff_Traigle · Accepted solution]

They don't all look at the same database file.

last uses /var/adm/wtmp
lastb uses /var/adm/btmp
who uses /etc/utmp

The man page for finger doesn't say what it uses, but based on your situation, I'd say it uses /etc/utmp also.

I would guess maybe your /var/adm/wtmp file is corrupt somehow that's keeping new entries from being added after 12/23. Make a copy of it and then clear it (i.e. "> /var/adm/tmp"). See if new sessions show up in "last" after that.

[Thomas Stuetzer]

Hello,
the wtmp file was not o.k.
see command wtmpfix
/usr/sbin/acct/wtmpfix < /var/adm/wtmp
Bad file at offset 494580
root root 28939 Thu Jan 1 09:02:19 1970

So I have decided to lost the date in file wtmp ( but have a backup file)
cp /var/adm/wtmp /var/adm/wtmp.old # backup
cat /dev/null > /var/adm/wtmp # delete data in wtmp

Now the last command is working fine
Thanks on all
Thomas

[Thomas Stuetzer]

cp /var/adm/wtmp /var/adm/wtmp.old # backup
cat /dev/null > /var/adm/wtmp # new file
Now the last command is working fine
Thanks on all
Thomas