wtmp gets filled

[jim bidebo]

have a problem... /var/adm/wtmp gets filled...
it looks like this when i use the "last" command:
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
root pts/0 Tue Jan 29 14:35 - 14:35 (00:00)
....

ps -edf |grep pts/0 doesnt give any information...
does anyone know what this can be?

[Sebastian Galeski_1]

Hi
perform;
# > /var/adm/wtmp
or SAM-> Routine Tasks ->System Log Files and trim to zero /var/adm/wtmp by menu action->trim -. trim to zero

hope it help

[Helen French]

Hi Jim,

Which OS version ? which server ? Do you have any cron job running which causes this ? Do you use Reflection for logging in ?

Try 'fuser' command to see what processes are running on pts/0. Also

# touch /var/adm/wtmp

HTH,
Shiju

[Corthouts Carlo]

The file /var/adm/wtmp contains a record of all logins and logouts.

The files can be zeroed or removed but if they are removed they need to be
manually recreated as they are not created by the programs that maintain them.

If you want to recreate them note the ownerships and permissions before removing them and reset the ownerships and permissions after recreating the files (usually with touch to create an empty files). This is EXTREMELY
important

[Trond Haugen]

The problem here is not actually wtmp filling up but finding what is filling it up.
The entries you describe show that root has logged in (and out again) 7 times within a minute. You will not find the pty in the ps list unless the line reads something like:
root console Mon Feb 21 10:30 still logged in

So your detective work will be to figure out what is causing this. Could be a cron job, a script or ..anything.
I would suggest starting by trying to find a pattern in when and how many entries there are.
In my view nilling out the wtmp file will only clear the symptom unless of course there is a valid reason for the entries.

[federico_3]

use the /usr/sbin/acct/fwtmp command in order to read the wtmp file. The form you should use is:

/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/filetemp

Then you can read the informations (you would have seen with last ) in the file /tmp/filetemp.

Bye

[Paula J Frazer-Campbell]

Jim

I you can stop the cron for long enough to examine the wtmp and see if this is cron related.

/sbin/init.d/cron stop
/sbin/init.d/cron start



HTH

Paula

[Corthouts Carlo]

Could you tell us what version of HP-UX you are using?

[jim bidebo]

Not as hard as it seamed, the problem was that it tried to start a dtlogin session at the local display, but no local display was attached.
Solved now.