`who -b ` does not produce any information

[Kennedy G. Doss]

Fellow SAs:

Has anybody seen this, before. Is there a patch or something which is need to fix this? I run the who -b command and it comes back to the prompt without any results. More detals pasted below:

# who -b
# uptime
12:04pm up 138 days, 19:56, 6 users, load average: 0.19, 0.18, 0.18
# uname -a
HP-UX newhostit B.11.11 U 9000/800 1611884041 unlimited-user license
# ls -lrt /etc/ut*
-rw-r--r-- 1 root root 660 Oct 3 12:05 /etc/utmp
-rw-r--r-- 1 root root 1540 Oct 3 12:05 /etc/utmpx
#

[Tim Nelson]

11.11 is getting close to desupport.

If you do not have the last ( latest ) bundle then it should be put on as it may just be the last.

Problem may just go away.

Are you at anything close to current ?
The latest is June '08.

swlist -l bundle|grep GOLDBASE

[Tim Nelson]

Another possibility is /etc/utmp or /var/adm/wtmp are corrupt.

Does the last command work ?
How about who -a ?

[Kennedy G. Doss]

who -a and who -u along with other switches for who work without an issue.

Is here a way to find out if my /etc/utmp and /var/adm/wtmp are corrupt?

[Tim Nelson]

I would have expected the other who commands to barf..as well as login messages complaining it cannot make an entry.

Where are you at with a patch bundle rev ?

or better yet.

# what /usr/bin/who
/usr/bin/who:
$Revision: B.11.11_LR
Fri Oct 27 00:32:29 PDT 2000 $

Looks like the who command has not changed in quite awhile. So probably not a patch issue.

[Pete Randall]

Tim,

A minor point but I would tend to disagree with your characterization that "11.11 is getting close to desupport". End of support is still 4 years and 2 months away:

http://www.hp.com/softwarereleases/releases-media2/history/slide2.html


Pete

[OldSchool]

well, its entirely possible that utmp / wtmp were "cleaned up" (emptied) at some point. which might clear the boot info.

emptying the files will not corrupt them, merely make the previous information unavailable, although if users are logged in at the time, they may get some ugly messages when they log out.

[Dennis Handly]

>OldSchool: it's entirely possible that wtmp were "cleaned up" (emptied) at some point. which might clear the boot info.

Right. "last reboot" should also show the last reboot time, if the data is in wtmp.

Are all of the /var/adm/wtmp* files emptied?
Otherwise you can use last with -x and/or -f to select the others.

[SKR_1]

Check with last reboot command. Is it working?

Thanks
SKR

[Kennedy G. Doss]

Here is an output of the last reboot. I am pasting only the first 10 entries.
ressnxp2(nm93572):/home/nm93572:$ last reboot | head -10
reboot system boot Sat May 17 16:10 still logged in
reboot system boot Sat May 17 15:23 - 16:10 (00:46)
reboot system boot Thu Nov 15 00:08 - 15:23 (184+14:15)
reboot system boot Mon Mar 19 15:15 - 00:08 (240+09:52)
reboot system boot Mon Mar 19 13:04 - 15:15 (02:11)
reboot system boot Mon Mar 19 12:13 - 13:04 (00:50)
reboot system boot Mon Mar 19 05:19 - 12:13 (06:53)
reboot system boot Sun Jun 11 02:09 - 05:19 (281+03:10)
reboot system boot Sun Jun 11 01:38 - 02:09 (00:30)
reboot system boot Sun Jun 11 00:13 - 01:38 (01:24)
ressnxp2(nm93572):/home/nm93572:$ who -b
ressnxp2(nm93572):/home/nm93572:$

-Kennedy

[SKR_1]

What about below command

who -b /var/adm/wtmp

Thanks

SKR

[Kennedy G. Doss]

Here is the output:

root:/:# who -b /var/adm/wtmp | head -10
. system boot Aug 24 11:47
. system boot Aug 25 17:47
. system boot Aug 27 14:24
. system boot Aug 27 15:54
. system boot Aug 27 16:31
. system boot Aug 27 16:42
. system boot Aug 30 13:18
. system boot Aug 30 15:58
. system boot Aug 30 18:26
. system boot Aug 31 12:43
root:/:#

[Dennis Handly]

>Here is an output of the "last reboot".

Ok, this data source is working.

>who -b /var/adm/wtmp | head -10

And this data source. (You really need tail -10.)

What is your real problem?
It appears that out of utmp/utmpx, utmpd, wtmp* some of those files have been truncated.

[Kennedy G. Doss]

Dennis,

My DBA Teams have "who -b" embedded in many of their automated scripts. Since it is not working now, all their scripts trigger off unwanted alerts. I know, if I reboot his server it may start working again without any issues. I just need to know if I can avoid a reboot. I also want to ensure that this is not any patch related issue which can be resolved without a reboot. (And you are correct, I should have done a tail -10 instead of head -10).

-Kennedy

[Dennis Handly]

>My DBA Teams have "who -b" embedded in many of their automated scripts. Since it is not working now, all their scripts trigger off unwanted alerts.

Ah, the real problem.

>if I reboot his server it may start working again without any issues. I just need to know if I can avoid a reboot.

The first thing to do would be to figure out where "who -b" is getting its data. You could use tusc to figure this out. This would be helpful so you know what not to do next time, truncate file?

Then you have several choices:
1) Reboot
2) Live with it until you until the other choices fix it.
3) Change the scripts to use "uptime" or "who -b /var/adm/wtmp" if "who -b" fails. Or just have it read the info from some manually created file in /etc/.
4) Write a program to fiddle with the data source.

Obviously 1) is pretty simple. 3) would be next.

>I also want to ensure that this is not any patch related issue which can be resolved without a reboot.

I seriously doubt that.

[Dennis Handly]

>ME: 4) Write a program to fiddle with the data source.

I used tusc and on 11.11 it seems that "who -b" (and so does uptime) opens /etc/utmp directly and reads it. So if this file has been truncated, you lost that info. I have no idea how uptime can give you some info?

We haven't asked you to do:
last -f /etc/utmp reboot

Using who -b /var/adm/wtmp would give info for users that aren't still logged on.

[Kennedy G. Doss]

I think we got into this issue because / filesystem got filled up and the /etc/utmp file for this reason gor initialized or lost some of the contents. This is what I had to do to repair/resolve the "who -b" issue:

To fix who -b issue:



Perform as root:
1) Create the ASCII version of utmp
# /usr/sbin/acct/fwtmp < /etc/utmp > /etc/utmp.ASCII



2) Edit the ASCII version
# vi /etc/utmp.ASCII
search for the system boot line (which probably isn't there) so add it!
duplicate the run-level line for the system boot line
ie. copy
run-level 3 0 1 0063 0123 850661195 Dec 15 08:46:35 1996
to look like
system boot 0 2 0000 0000 850661195 Dec 15 08:46:35 1996



3) Convert the ASCII back to BINARY
# /usr/sbin/acct/fwtmp -ic < /etc/utmp.ASCII > /etc/utmp.BIN



4) Save the original
# cp /etc/utmp /etc/utmp.SAVE



5) Make the new file active
# cp /etc/utmp.BIN /etc/utmp



6) Verify dates and who command
# who -b


I got this solution by opening up a ticket with the response center. I didnt find this solution when I searched at ITRC though.

Regards,
-Kennedy