>is there a way to make this file valid again without a reboot?
Sure, write a program.
Since you are on 11.11 you probably don't need to do that.
>Patrick: Not that I know of.
Right, there is no specific command(s) that will fix it. And even harder on 11.23 since there is utmps & utmpd.
>I guess we have to live with that until the next reboot.
(See easier way below, first.)
If you are ambitious you might try the following:
1) Back up /etc/utmp in case we make it worse.
2) You might be able to extract the info from a good system with dd(1).
3) Then use "cat >> /etc/utmp" to append to the end.
4) They try "who -r".
>if I study the tusc output and compare that to the one of another hp-ux machine it seems that 'who -r' searches for following entries in /etc/utmp:
system boot run-level
Of course. See utmp(4):
http://docs.hp.com/en/B2355-60130/utmp.4.htmlJust use tusc on a good system to compute where the good record is, then use dd to extract it.
In your tusc dump on the bad system, suppose this is the entry you want to copy:
read(5, "x x x x x x x \0t s / 7 p t s / ".., 60)
Counting from 0, this is record 7:
dd if=/etc/utmp of=runlevel bs=60 iseek=7 count=1
Then just copy to the bad system and do:
cat runlevel >> /etc/utmp
Actually since it is /etc/utmp you can do:
1) On good system:
2) /usr/sbin/acct/fwtmp < /etc/utmp | grep "run-level " > runlevel
3) Copy runlevel to bad system
4) On bad system
5) /usr/sbin/acct/fwtmp < /etc/utmp > utmp.txt
6) cat runlevel >> utmp.txt
7) cp /etc/umtp utmp.save
8) /usr/sbin/acct/fwtmp -ic < utmp.txt > /etc/utmp
>I can't find both of these entries in /etc/utmp on the machine with issues.
Yes, someone emptied out /etc/utmp and lost that entry.
