wtmp growning fast

[ktate777]

The following messages are filling my /var/adm/wtmp file very fast. Any ideas?

oracle rsh90132 Dec 23 13:32 (pan)
oracle rsh90134 Dec 23 13:32 (pan)
oracle rsh90138 Dec 23 13:33 (pan)
oracle rsh63754 Dec 23 13:33 (pan)
oracle rsh90146 Dec 23 13:33 (pan)
oracle rsh90150 Dec 23 13:33 (pan)
oracle rsh63762 Dec 23 13:34 (pan)
oracle rsh90162 Dec 23 13:34 (pan)
oracle rsh74538 Dec 23 13:34 (pan)
oracle rsh63770 Dec 23 13:34 (pan)
oracle rsh90178 Dec 23 13:34 (pan)
oracle rsh47598 Dec 23 13:35 (pan)
oracle rsh47600 Dec 23 13:35 (pan)
oracle rsh64094 Dec 23 13:35 (pan)
oracle rsh64098 Dec 23 13:35 (pan)
oracle rsh63776 Dec 23 13:36 (pan)
oracle rsh63778 Dec 23 13:36 (pan)
oracle rsh63784 Dec 23 13:36 (pan)
oracle rsh63788 Dec 23 13:36 (pan)
oracle rsh63792 Dec 23 13:36 (pan)
oracle rsh45332 Dec 23 13:37 (pan)
oracle rsh45336 Dec 23 13:37 (pan)
oracle rsh63800 Dec 23 13:37 (pan)
oracle rsh45354 Dec 23 13:37 (pan)

 

[p5wizard]

user oracle is frequently (4 times per minute) rsh-ing from other host (pan) to the server where you are.

I clean up my wtmp file on a daily basis:

/usr/sbin/acct/nulladm /var/adm/wtmp

You can also use fwtmp command to convert wtmp file to ascii readable text, decide what you want to keep and remove all the rest (editable text file).

HTH,

p5wizard

 

[BocaBurger]

Find out why user oracle is rsh-ing to this server so frequently. Ask the DBA.



BocaBurger
<===========================||////////////////|0
The pen is mightier than the sword, but the sword hurts more!