Updates to the SU log file are incorrect?

[Managed Services]

Whenever I use the SU command as my own adminstration login, the record of this action appears in the SU log file as a totally separate user id. If I log in later, another different user id may appear as myself, or the same login id may appear as earlier. My own login id does not appear.
Does anyone know why this may be??

[T G Manikandan]

su gets the information from the /etc/utmp & utmpx files

Just do a
#cat /dev/null >/etc/utmp
#cat /dev/null >/etc/utmpx

But you have to do them in the single user level or single user mode.

Fix up a time for the reboot


Thanks

[Michael Tully]

I have a similar problem on two servers that I have. There are two problems. First the /etc/utmp is probably corrupted and secondly you need to apply some patches to your system. (My other production servers are a later patch level) Having the later patches will fix your problem with the /etc/utmp entries which is where 'su' and other programs like 'ftp' get it's information.

[T G Manikandan]

hpux 11.0
http://www1.itrc.hp.com/service/patch/patchDetail.do?patchid=PHNE_26096&context=hpux:800:11:00

hpux 11.11
http://www1.itrc.hp.com/service/patch/patchDetail.do?patchid=PHNE_24829&context=hpux:800:11:11

[Managed Services_1]

Thanks for that.
Catting /dev/null to utmp and utmpx has now resolved the problem.
i will install the patches at a later date.
Many thanks again!!

[T G Manikandan]

you are using two different logins!

[T G Manikandan]

you are using two different logins here at the forums!

[aparna challagulla]

hi,

what makes u think so? that he/she is using two diff login names.

just curious
aparna

[T G Manikandan]

check his profile at this post.
One has a star and he is the author.

One has "unassigned" points for him.
he can assign points to his own different userid.

[Managed Services]

cool! Never thought of that being as honest as I am!

[aparna challagulla]

yes TGM,
u r right. he/she is using two logins.
i wonder y?
anyway thx for clarifying.
rgds
aparna

[T G Manikandan]

Everything looks fine except the bunnies!?

[Jeff Schussele]

Hi,

This is the classic symptom of utmp/utmpx corruption. There is a patch - PHNE_24829:

http://www2.itrc.hp.com/service/patch/patchDetail.do?patchid=PHNE_24829&context=hpux:800:11:11

that addresses the telnetd caused corruption.
We had the same problem & this patch fixed the problem.
NOTE that there are special instructions on this patch that *must* be followed for the fix to work.

HTH,
Jeff