/var/adm/wtmp growing like crazy 3

[Einstein47]

I just upgraded from 4.3.3 to 5.2.2 and now the wtmp file in /var/adm/ is growing like crazy. I have to go in every other day and clean it out with > wtmp.

Is there a reason for this file to grow like crazy? Our servers are app servers, so there isn't a lot of user interaction. What might be the cause? What kinds of things should I look for to determine what is writing to wtmp?

Einstein47
(Trouble is a sieve through which we sift our acquaintances. Those too big to pass through are our friends. - Arlene Francis)

 

[hfaix]

Do you know what's writing to the file so much?

You will have to convert wtmp to ascii by running

/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/fwtmp.txt

This will use the ftwmp program to turn /var/adm/wtmp into a text file. You can then read the text file to see what is writing to wtmp so much.

you can edit this in vi then move it back if you want to keep part of it, with:

/usr/sbin/acct/fwtmp -ic < /tmp/fwtmp.txt > /var/adm/wtmp



Good Luck!



I had the same thing happen. It turned out be be a ton of lft messages in my cases. You'll have to reevaluate once you read the file.

 

[Einstein47]

Ok - first star for helping me find out that it is

a ton of lft messages

which means that I will need to seek your advice as well in the best way to take care of the lft problem.

We used to have an lft with several ports so that we could monitor our systems with only one piece of hardward, but like all hardware based solutions, it is no longer functional. So, the question becomes, how did you take care of your lft issue? I'm thinking that our situations are more similar than we realize.

Thanks for the help so far. Man, I love Tek-tips.

Einstein47
(Sometimes you're the windshield... sometimes you're the bug - Unknown)

 

[hfaix]

I would do an lsdev -Cc tty and verify you're not using lft. I wasn't. I'm guessing you're not if you're getting these errors. If lft isn't listed, then you're not using it.

I then made an /etc/inittab change. I commented out the line that said lft:2:respawn: /usr/sbin/getty /dev/lft0 ( or something to that affect).

This should take care of it.

good luck.

 

[Einstein47]

I just noticed the inittab entries before you replied - I commented them out because I am not using lft.

Thank you again - double stars are kind of nifty.

Einstein47
(Sometimes you're the windshield... sometimes you're the bug - Unknown)

 

[Birbone]

Thanks hfaix.

-B

 

[ggitlin]

There is also a script in adm user's crontab, I think it is called chkpacct, which switches off the logging into wtmp, when /var filesystem is filling up and switches it back on when free space is back to he appropriate levels. Doesn't make wtmp stop grouing, though. Just thought it might be useful in your case.

Good luck.

Greg.