Sponsored Content
Operating Systems Solaris Something is removing/deleting my wtmpx file? Post 302777003 by hicksd8 on Thursday 7th of March 2013 08:49:05 AM
Old 03-07-2013
Hmmmmm! Perhaps the previous sysadmins was trying to be clever.

If you have /usr/lib/acct/runacct post the contents of that. Sometimes lines can be added there to zeroise wtmpx.

Are there any other crontabs that could be being used? adm, sys or whatever.

There is also the possibility that another box is scripted to remotely execute a script on this box. Previous sysadmins being really clever by doing centralised housekeeping?
 

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

how to delete entry in file "wtmpx"(/var/adm/wtmpx)

Do someone know how to delete entry(some lines) in file "wtmpx" that command "last" use it. this file is binary so I cannot edit directy. ========================= #last root pts/1 noc Fri Mar 3 22:04 still logged in root pts/1 noc Fri Mar 3 22:01 - 22:02 ... (4 Replies)
Discussion started by: arm_naja
4 Replies

2. UNIX for Dummies Questions & Answers

wtmpx file

Hello everybody: the wtmpx file on my Sol8 machine, got so big (2GB), that my root partition is almost full now, can I empty that file, I read about it that it contains database of user access and auditing, so in case I emptied it will it affect my system?? Thanks alot (3 Replies)
Discussion started by: aladdin
3 Replies

3. Solaris

wtmpx file is too big

Hi, I am using Sun Solaris 5.9 OS. I have found a file called wtmpx having a size of 5.0 GB. I want to clear this file using :>/var/adm/wtmpx. My query is, would it cause any problem to the running live system. Could anyone suggest the best method to clear the file without causing problem to... (6 Replies)
Discussion started by: Vijayakumarpc
6 Replies

4. UNIX for Advanced & Expert Users

wtmpx file is not updating

Hi in my solaris 9 system wmptx file is not updating so it is not recording any login or logout or any other entry. can any one tell me how to solve this problem (0 Replies)
Discussion started by: aaysa123
0 Replies

5. Solaris

wtmpx file

What could possibly happen if wtmpx file got deleted by mistake? Thanks, (8 Replies)
Discussion started by: Pouchie1
8 Replies

6. UNIX for Dummies Questions & Answers

Deleting/Removing sentence from .txt

Hi, now i need to remove the entires i inserted into my .txt file. echo -n "Title: " read Title echo -n "Author: " read Author if grep -q "$Title: $Author" "BookDB.txt"; then sed '$Title: $Author' BookDB.txt echo "Book Title '$Title' removed successfully!" ... (6 Replies)
Discussion started by: santonio
6 Replies

7. Shell Programming and Scripting

Deleting pattern without removing line

I am trying to delete a pattern without removing line. I searched a lot in this forum and using those I could come up with sed command but it seems that command does not work. Here's how my file looks like: 1 ./63990 7 1171 ./63990 2 2425 ./63990 9 2539 ./63990 1 3125 ./63990 1 10141... (7 Replies)
Discussion started by: shoaibjameel123
7 Replies

8. Solaris

WTMPX File corrupted

Hi All I work on solaris 8, 9 and 10 platforms and have encountered an error which is my wtmpx files appear to be corrupted as all entries contain the date 1970 (the birth of unix). Now this is obviously not the case, so my query is: 1 - Can the existing wtmpx files be manipulated to... (6 Replies)
Discussion started by: drestarr96
6 Replies

9. Solaris

Wtmpx File Permissions Question

Hi all, I have been tasked to change permissions on the wtmpx file to 640. Currently the permissions are at 644. My question is will anything be affected if I change the permissions as shown? Thanks in advance. Derek (2 Replies)
Discussion started by: Derk Berk
2 Replies

10. UNIX for Advanced & Expert Users

Getting information from the wtmpx file

Hi, I tried running the command "last" in the server to check the users that were last logged into the system. However, I get this error : root@csidblog:# last /var/adm/wtmpx: Value too large for defined data type How do I proceed to get this info? I read some forums suggesting to use... (2 Replies)
Discussion started by: anaigini45
2 Replies
runacct(1M)						  System Administration Commands					       runacct(1M)

NAME
runacct - run daily accounting SYNOPSIS
/usr/lib/acct/runacct [ mmdd [state]] DESCRIPTION
runacct is the main daily accounting shell procedure. It is normally initiated using cron. runacct processes connect, fee, disk, and process accounting files. It also prepares summary files for prdaily or billing purposes. runacct is distributed only to source code licensees. runacct takes care not to damage active accounting files or summary files in the event of errors. It records its progress by writing descriptive diagnostic messages into active. When an error is detected, a message is written to /dev/console, mail (see mail(1)) is sent to root and adm, and runacct terminates. runacct uses a series of lock files to protect against re-invocation. The files lock and lock1 are used to prevent simultaneous invocation, and lastdate is used to prevent more than one invocation per day. runacct breaks its processing into separate, restartable states using statefile to remember the last state completed. It accomplishes this by writing the state name into statefile. runacct then looks in statefile to see what it has done and to determine what to process next. states are executed in the following order: SETUP Move active accounting files into working files. WTMPFIX Verify integrity of wtmpx file, correcting date changes if necessary. CONNECT Produce connect session records in tacct.h format. PROCESS Convert process accounting records into tacct.h format. MERGE Merge the connect and process accounting records. FEES Convert output of chargefee into tacct.h format, merge with connect, and process accounting records. DISK Merge disk accounting records with connect, process, and fee accounting records. MERGETACCT Merge the daily total accounting records in daytacct with the summary total accounting records in /var/adm/acct/sum/tacct. CMS Produce command summaries. USEREXIT Any installation dependent accounting programs can be included here. CLEANUP Clean up temporary files and exit. To restart runacct after a failure, first check the active file for diagnostics, then fix any corrupted data files, such as pacct or wtmpx. The lock, lock1, and lastdate files must be removed before runacct can be restarted. The argument mmdd is necessary if runacct is being restarted. mmdd specifies the month and day for which runacct will rerun the accounting. The entry point for processing is based on the contents of statefile; to override this, include the desired state on the command line to designate where processing should begin. EXAMPLES
Example 1: Starting runacct The following example starts runacct: example% nohup runacct 2> /var/adm/acct/nite/fd2log & Example 2: Restarting runacct The following example restarts runacct: example% nohup runacct 0601 2>> /var/adm/acct/nite/fd2log & Example 3: Restarting runacct at a Specific State The following example restarts runacct at a specific state: example% nohup runacct 0601 MERGE 2>> /var/adm/acct/nite/fd2log & FILES
/var/adm/wtmpx History of user access and administration information /var/adm/pacctincr /var/adm/acct/nite/active /var/adm/acct/nite/daytacct /var/adm/acct/nite/lock /var/adm/acct/nite/lock1 /var/adm/acct/nite/lastdate /var/adm/acct/nite/statefile ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |Availability |SUNWaccu | +-----------------------------+-----------------------------+ SEE ALSO
acctcom(1), mail(1), acct(1M), acctcms(1M), acctcon(1M), acctmerg(1M), acctprc(1M), acctsh(1M), cron(1M), fwtmp(1M), acct(2), acct.h(3HEAD), utmpx(4), attributes(5) NOTES
It is not recommended to restart runacct in the SETUP state. Run SETUP manually and restart using: runacct mmdd WTMPFIX If runacct failed in the PROCESS state, remove the last ptacct file because it will not be complete. The runacct command can process a maximum of o 6000 distinct sessions o 1000 distinct terminal lines o 2000 distinct login names during a single invocation of the command. If at some point the actual number of any one of these items exceeds the maximum, the command will not succeed. Do not invoke runacct at the same time as ckpacct, as there may be a conflict if both scripts attempt to execute turnacct switch simultane- ously. SunOS 5.10 11 May 1999 runacct(1M)
All times are GMT -4. The time now is 02:00 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy