I have an aix 5.2 ml4 system whose /var/adm/wtmp file grows extremely quickly. When using:
/usr/sbin/acct/fwtmp < wtmp
on it, I get a plethora of records as follows:
rfproddb:/var/adm# /usr/sbin/acct/fwtmp < wtmp | tail
IWH IWH 5 74890 0000 0000 1100871636 Fri Nov 19 06:40:36 MST 2004
IWH 8 74890 0000 0000 1100871636 Fri Nov 19 06:40:36 MST 2004
IWH IWH 5 74892 0000 0000 1100871636 Fri Nov 19 06:40:36 MST 2004
IWH 8 74892 0000 0000 1100871636 Fri Nov 19 06:40:36 MST 2004
IWH IWH 5 74894 0000 0000 1100871636 Fri Nov 19 06:40:36 MST 2004
IWH 8 74894 0000 0000 1100871637 Fri Nov 19 06:40:37 MST 2004
IWH IWH 5 74896 0000 0000 1100871637 Fri Nov 19 06:40:37 MST 2004
IWH 8 74896 0000 0000 1100871637 Fri Nov 19 06:40:37 MST 2004
IWH IWH 5 74898 0000 0000 1100871637 Fri Nov 19 06:40:37 MST 2004
IWH 8 74898 0000 0000 1100871637 Fri Nov 19 06:40:37 MST 2004
I can't seem to find out what this IWH thing is. Whatever it is, its placing entries into wtmp multiple times a second!
Anyone know what that is or a way to find out? Using lsof doesn't get me anywhere...
Thanks!
---
Batavus
/usr/sbin/acct/fwtmp < wtmp
on it, I get a plethora of records as follows:
rfproddb:/var/adm# /usr/sbin/acct/fwtmp < wtmp | tail
IWH IWH 5 74890 0000 0000 1100871636 Fri Nov 19 06:40:36 MST 2004
IWH 8 74890 0000 0000 1100871636 Fri Nov 19 06:40:36 MST 2004
IWH IWH 5 74892 0000 0000 1100871636 Fri Nov 19 06:40:36 MST 2004
IWH 8 74892 0000 0000 1100871636 Fri Nov 19 06:40:36 MST 2004
IWH IWH 5 74894 0000 0000 1100871636 Fri Nov 19 06:40:36 MST 2004
IWH 8 74894 0000 0000 1100871637 Fri Nov 19 06:40:37 MST 2004
IWH IWH 5 74896 0000 0000 1100871637 Fri Nov 19 06:40:37 MST 2004
IWH 8 74896 0000 0000 1100871637 Fri Nov 19 06:40:37 MST 2004
IWH IWH 5 74898 0000 0000 1100871637 Fri Nov 19 06:40:37 MST 2004
IWH 8 74898 0000 0000 1100871637 Fri Nov 19 06:40:37 MST 2004
I can't seem to find out what this IWH thing is. Whatever it is, its placing entries into wtmp multiple times a second!
Anyone know what that is or a way to find out? Using lsof doesn't get me anywhere...
Thanks!
---
Batavus