who -b does not return anything

[Raveesh]

who -b and who -r does not return anything on hp-ux 11i. /etc/utmp, /var/adm/wtmp are looks ok. All other options are working except these two, Any solution for this problem?

[Chris Wilshaw]

Do any of the other options for who work? If not, it's possible that your binary has been truncated.

Check the size of /usr/bin/who

[Sridhar Bhaskarla]

Hi,

Looks like reboot entry is missing from your *tmp files.

What does your last -R |grep reboot give?.

If it doesn't give anything, then it could be the reason.

-Sri

[Robert-Jan Goossens]

Hi,

check
# what who
and
# ls -l /usr/bin/who

Think you have lost your command.

Robert-Jan.

[ITeam]

I had the same problem on two different customer sites. The only solution I had for the problem was to do a reboot. This sorted the problem out okay.

[Sridhar Bhaskarla]

No. Reboot is not the solution. It just makes an entry in the wtmp file so that these options work.

It will happen if you recycled your wtmp files and that might have missed the reboot entries. If your "last -R |grep reboot" does not give any output, that means your last reboot entry has been deleted from your wtmp. You won't see any output from who -b and who -r as both need to get the last reboot details.

-Sri

[Raveesh]

I did last -R |grep reboot, it was listing all the reboots. And also copied working /usr/bin/who from other machine and deleted /etc/utmp. Still having the same problem.

[Robert-Jan Goossens]

Hi,

Quote

I didn't get any replies for this question but HP support gave me one
alternative. Reboot may fix the problem. Well that didn't sit real well as a
solution so I went off on my own to solve the problem. Here is a synopsis:

symptom:

The command "who -b" doesn't return the system boot time.
It should look like this
# who -b
. system boot Dec 15 08:46
#
When corrupt it looks like this
# who -b
#

To fix:

Perform as root:
1) Create the ASCII version of utmp
# /usr/sbin/acct/fwtmp < /etc/utmp > /etc/utmp.ASCII

2) Edit the ASCII version
# vi /etc/utmp.ASCII
search for the system boot line (which probably isn't there) so add it!
duplicate the run-level line for the system boot line
ie. copy
run-level 3 0 1 0063 0123 850661195 Dec 15 08:46:35 1996
to look like
system boot 0 2 0000 0000 850661195 Dec 15 08:46:35 1996

3) Convert the ASCII back to BINARY
# /usr/sbin/acct/fwtmp -ic < /etc/utmp.ASCII > /etc/utmp.BIN

4) Save the original
# cp /etc/utmp /etc/utmp.SAVE

5) Make the new file active
# cp /etc/utmp.BIN /etc/utmp

6) Verify dates and who command
# who -b

I hope this helps if anyone has this problem. I haven't tried the reboot
solution but imagine since the /etc/utmp file is recreated is probably would
work also.

Robert-Jan.

[Raveesh]

Hi Robert,

I did the same thing whatever you specified, still it is not working. HP suggested to reboot the box :)