Solaris 9 user logins not in last 1

[maximusGeek]

User logins suddenly stopped showing up in last. Anyone know why that might be? I have 8 servers with identical configurations and only one is having this problem. I am running OpenSSH but I am on all servers.

 

[Annihilannic]

Your /var/adm/wtmpx file may be corrupt... or too large? Try wtmpfix perhaps (although in my experience it has rarely helped - check the man page for usage), or if you can afford to lose the data, flatten (e.g. > /var/adm/wtmpx) the existing file so that it starts from the beginning again.

Annihilannic.

 

[Annihilannic]

An alternative, if you don't wish to lose all of the data in the file, and if you can figure out the correct record size to use, is to use dd with the bs= option set to the record size and skip= option set to the number of records you want to discard, e.g.

dd bs=652 skip=100000 if=/var/adm/wtmpx of=/var/adm/wtmpx.new
mv /var/adm/wtmpx /var/adm/wtmpx.old && mv /var/adm/wtmpx.new /var/adm/wtmpx
# change permissions to match old file

Don't use 652 though, that's just my wild guess at the record size!

Annihilannic.

 

[maximusGeek]

Thanks! Resolved

 

[KenCunningham]

Maximus - it would be a fitting end to this thread to perhaps tell us how ;-)

Some days are diamonds, some days are rocks - make sure most are the former.

 

[AvayaTier3]

# login must be root
ls -ltr *tmpx
/var/adm
-rw-r--r-- 1 adm adm 2840592 Sep 22 13:28 wtmpx
-rw-r--r-- 1 root bin 27156 Sep 23 14:53 utmpx
This would work for Solaris 10:

cd /var/adm
rm utmpx wtmpx
touch utmpx wtmpx
chown adm wtmpx
chgrp adm wtmpx
chown root utmpx
chgrp bin utmpx
chmod 644 wtmpx
chmod 644 utmpx

ls -ltr *tmpx
/var/adm
-rw-r--r-- 1 adm adm 0 Sep 22 13:28 wtmpx
-rw-r--r-- 1 root bin 0 Sep 23 14:53 utmpx

This will start logging from scratch.

A great teacher, does not provide answers, but methods to teach others "How and where to find the answers"

bsh

35 years Bell, AT&T, Lucent, Avaya
Tier 3 for 25 years and counting

http://bshtele.com

 

[KenCunningham]

This would do the same:

cat /dev/null > /var/adm/?tmpx

Some days are diamonds, some days are rocks - make sure most are the former.

 

[Annihilannic]

You should never need to do that to utmpx unless something is badly wrong, since it generally only contains records for users who are currently logged in. In fact, I'd recommend avoiding it in case bad things start happening... like uptime not reporting the correct time since reboot and stuff? Not sure that would happen, but... who -r may also report strange stuff.

Ken, I don't think that has quite the effect you expect:

$ touch atmpx btmpx
$ date > ?tmpx
$ ls -l ?tmpx
-rw-r--r--   1 anni    other         29 Sep 25 10:58 ?tmpx
-rw-r--r--   1 anni    other          0 Sep 25 10:58 atmpx
-rw-r--r--   1 anni    other          0 Sep 25 10:58 btmpx
$

But I'm with you there, just flattening the file is sufficient. > /var/adm/wtmpx on its own will do.

Annihilannic.

 

[KenCunningham]

Hey, Anni, thanks for that correction. I have to admit I hadn't tested it (and should have made that clear).

Some days are diamonds, some days are rocks - make sure most are the former.