/var/adm has two wtmp files

[Rocky_2]

HPUX 11.00 wtmp became corrupted. Unable to delete it. It has a file size of 0. Created a new one that seems to be working fine, but the /var/adm/ directory has two instances of wtmp. Should I just ignore this?
Thanks

[PIYUSH D. PATEL]

Hi,

You should not create or delete the wtmp file.

You can just issue a command

#cat /dev/null > /var/adm/wtmp
or
# > /var/adm/wtmp

This will automatically make the size of wtmp file as 0.

You can delete the new file which you have created.

Execute the who or last command and if they are giving you the output then your wtmp file is OK.

Piyush

[James R. Ferguson · Accepted solution]

Hi Rocky:

The working one is the active one. I suspect that you ended up naming the other (zero length) one with non-printable (viewable) characters. To expose them do:

# ls -lib /var/adm/wtmp

This also adds the inode to the listing.

Note which file is which and do:

# rm -i /var/adm/wtmp

Respond "y" to the one you want removed.

In the future, if you want to null the file to record from that point foward, do:

# cat /dev/null > /var/adm/wtmp

Regards!

...JRF...

[Rocky_2]

Hi,
The long list (ll) command lists two wtmp files. The command suggested by Mr Ferguson ls -lib /var/adm/wtmp listed only one. The rm -i/var/adm/wtmp also listed only one file.
Thanks

[PIYUSH D. PATEL]

Hi,

So your problem is solved now....r u getting the proper output of who and last ??

Piyush

[Darrell Allen]

Hi,

I also suspect there is an unprintable character (or more) in one of the file names. Try the commands James suggests but specify wtmp* instead of simply wtmp. I've never seen UNIX allow two files in the same directory to have the same name.

Darrell

[Thomas J. Harrold]

Try "ls -q" in the /var/adm/
directory. This will replace non-printable characters with the "?" character.

Also, just execute an "ls -i" without any arguments. This will show you the inodes for ALL files in /var/adm, and then you can use:

find . -inum -exec rm {} \;

-tjh

[Rocky_2]

Thanks for the help. Used a combination of your suggestions to delete the incorrect file.
ls -q showed the file listed as /var/adm/wtmp\010. Deleted the file with the command rm -i /var/adm/wtmp* and responded with "y" at the prompt to delete the file "wtm".