Problem with last command reverting to 1969

[Steven E. Protter]

HP-UX 11.31 IA-64
all systems.

root@rxq24hxd# last

WTMPS_FILE begins at Wed Dec 31 17:59:59


This refers to a date in 1969.

swlist -l bundle | grep OE
HPUX11i-OE-Ent B.11.31.0709 HP-UX Enterprise Operating Environment


root@rxq24hxd# swlist -l bundle | grep QPK
QPKAPPS B.11.31.1009.353a Applications Patches for HP-UX 11i v3, September 2010
QPKBASE B.11.31.1009.353a Base Quality Pack Bundle for HP-UX 11i v3, September 2010


I know the Core OS is pretty dated, I'm working on this.

Data is being collected in the appropriate files /var/adm/wtmp etc.

We have tried clearing out the files and rebooting no help there.

These boxes were patched October 27 2010 but three boxes that were not patched also have the problem.

Systems do authenticate with LDAP, though not for root.

root@rxq24hxd# swlist -l bundle | grep LDAP
LDAPUX

Can not share the ldap or pam configuration but LDAP went into production many months ago and three months ago the audit reports were good.


A case is open with HP support, has been for a day and has just been escalated to backline support.

Who is faster, backline or the ITRC community.

Generous points for a proven fix. Something for suggestions even if we've tried them.

SEP

[Patrick Wallek]

I was just able to duplicate your problem.

1) I cleared out /var/adm/wtmp* files
# > wtmp
# > wtmps
# > wtmpx

2) I ran the "last" command and it showed the same message you received.

3) I logged into the server and then ran "last" again. The output then showed:

# last
root pts/1 Thu Feb 10 13:12 still logged in

WTMPS_FILE begins at Thu Feb 10 13:12:13



The "WTMPS_FILE begins at Wed Dec 31 17:59:59" is normal behavior for an empty file. If you do an 'll /var/adm/wtmp*' you will probably see all files as empty.

So, I think you just need to log into the system to cause something to be written to wtmp.

If just logging in with LDAP is not causing something to be written to wtmp*, then that may be a problem with either LDAP or PAM.

[James R. Ferguson]

Hi SEP:

The beginning of the UNIX epoch (0) was January 1, 1970 in UTC (GMT). Hence date/times of "December 31, 1969" represent the localtime west of Greenwich.

I would expect an empty/uninitialized file to exhibit this kind of value.

Regards!

...JRF...

[Steven E. Protter]

Tried post 1.

Files have contents, Though 11.31 seems to have muddied the waters with new files.

We have an archive scheme running and maybe it hit something.

This was not caused by patching, not all systems exhibiting this behavior have been patched.

SEP

[Steven E. Protter]

I'm on an airplane atm, just brought up a system I ignited.

That system has data in the wtmps file.

Systems exhibiting this behavior all have 0 bytes in the file.

So the question becomes what is emptying out the file? Summary JRF is right.

SEP

[Patrick Wallek]

>>So the question becomes what is emptying out the file?

cron job? logrotate? What is the date/time stamp on the file(s) that are 0 bytes in size? Perhaps that can guide you to who/what is causing the problem.

[Dennis Handly]

>WTMPS_FILE begins at Wed Dec 31 17:59:59

As JRF suggested, what timezone are you in? CST6CDT? This would equal (time_t)-1.