Unusual output from wtmp

[Craig Rants]

I have just come upon something that maybe someone can shed some light on. Not on how to fix the problem, but more about why.

When I run a "last | grep still" I get about 40 of these:

root rexecd Sat Dec 8 15:41 still logged in
user1 ftp Fri Dec 7 13:38 still logged in

However, I am the only one logged on. I know how to fix this with fwtmp, and why I would see this for telnet, but I don't know why I got so many in a short amount of time for rexecd and ftp.

If someone has seen this type of anomaly before I would appreciate some background info.

Thanks,
Craig

[Sridhar Bhaskarla]

Hi Craig,

Did you check up the man page for last?. It says

last indicates if the session is still in progress or if it was cut
short by a reboot.

So, you might have rebooted the box when those sessions were up.

-Sri

[Craig Rants]

Shridar,
I thought about that, both the source and destination boxes have not been rebooted since well prior to these entries.
Thanks,
Craig

[S.K. Chan · Accepted solution]

Do you have any ReflectionX session still active ? I know that ReflectionX actually runs rexec to call hpterm. That might explain why you got these entries in wtmp. Another thing is a "parent-rexecd" can spawn other child processes and even though the "parent-rexecd" is killed, there might be some child processes still active.

[S.K. Chan]

Check out this patch (for 11.0), it has fixes for rexecd not updating wtmp and btmp properly.
PHNE_21731

[Helen French]

hey,

I agree with Chan ... i have observed these same stuffs and i found most of them have come from my ReflectionX software which run an 'rexec' command.

I have found same thing with some of the ftp sessions too !

Shiju

[Craig Rants]

Thanks for the input, both the patch or Reflection could be the prob, I'll look into both.

Thanks,
C

[Bill Hassell]

Be sure that wtmp is less than one year old. A very large wtmp file (last reads this file) may have 2-4 years worth of data and the data from 2 years ago will look like it is this year's data.

Also, as mentioned, PC crashes are the leading cause of corrupted utmp and wtmp entries, caused primarily by improper exiting of processes and login sessions.