/var/adm/wtmp - few entries & huge size. Post: 302481890

Sponsored Content

Operating Systems AIX /var/adm/wtmp - few entries & huge size. Post 302481890 by shockneck on Monday 20th of December 2010 06:08:31 AM

12-20-2010

Registered User

Quote:

Originally Posted by robroy

[...] /var/adm/wtmp on server01 is ~ 400MB large but it only has ~1200 lines. For example on server02 there are ~85000 lines and the file is ~158MB large. I check lines through 'last | wc -l'. But when I check line directly with 'wc -l /var/adm/wtmp' for server01 I have 22483 lines and for server02 10575 lines. [...]Where is the strange difference comming from?

This might happen if sbdy tried to shrink wtmp in a not supported way. I.e. if you do not blank it (e.g. cating /dev/null onto it) or write data back without using fwtmp you might damage wtmp in a way that only parts of it are usable. The second possibility is that /var got full 100% at the very moment the system logged information in wtmp. Either way you end up with a wtmp file where size and information do not seem to fit together.

How to shrink wtmp correctly has been explained a thousand times before. This procedure might also be used to repair a broken wtmp. You might want to search this group.

shockneck

View Public Profile for shockneck

Find all posts by shockneck

10 More Discussions You Might Find Interesting

1. Solaris

/var/adm/loginlog

As root I have created the loginlog file in /var/adm with permissions (r and w) for root:root only. Failed attempts(> 5) to log in as root do not get logged in the file. What am I missing?? I am on a Solaris 8 Box. :confused: :confused: :confused:

2. Solaris

sometime /var/adm/messages size 0

Hi experts, sometimes i notice in my Solaris 9 /var/adm/messages size 0. It continues for 1/2 days then again /var/adm/messages is start filling up with logs!!! What could be reason behind it. and if its a problem what could be the solution. //purple

3. AIX

Impacts of emptying /var/adm/wtmp file ?

In our operating procedures, if a workstation has a space problem in the /var filesystem, one of the most frequent case we were told is the size of the /var/adm/wtmp file. Someone once told me it is dangerous to do this. Is it ? I cannot say for certain that whomever wrote that procedure is...

4. Solaris

diff b/w /var/log/syslog and /var/adm/messages

hi sirs can u tell the difference between /var/log/syslogs and /var/adm/messages in my working place i am having two servers. in one servers messages file is empty and syslog file is going on increasing.. and in another servers message file is going on increasing but syslog file is...

5. Solaris

/var/adm & /var/sadm

what is the difference between tha /var/adm and /var/sadm files in solaris 10 Os please can any one respond quickly thanking you

6. Solaris

Difference between /var/log/syslog and /var/adm/messages

Hi, Is the contents in /var/log/syslog and /var/adm/messages are same?? Regards

7. Shell Programming and Scripting

Optimised way for search & replace a value on one line in a very huge file (File Size is 24 GB).

Hi Experts, I had to edit (a particular value) in header line of a very huge file so for that i wanted to search & replace a particular value on a file which was of 24 GB in Size. I managed to do it but it took long time to complete. Can anyone please tell me how can we do it in a optimised...

8. AIX

ftpd failed to write /var/adm/wtmp not owner

dear all this attached photo is send to me from Arcsight admin can you please advice ftpd failed to write /var/adm/wtmp not owner ftpd failed to write /var/adm/wtmp error 0

9. Solaris

/var/adm/messages (interface turned off/restored) and link up & link down message.

Hi All I am facing an issue with our new solaris machine. in /var/adm/messages root@Prod-App1:/var/tmp# root@Prod-App1:/var/tmp# root@Prod-App1:/var/tmp# cat /var/adm//messages Apr 20 03:10:01 Prod-App1 syslogd: line 25: WARNING: loghost could not be resolved Apr 20 08:24:18 Prod-App1...

10. Solaris

/var/adm/messages (insterface turned off/restored) and link up & link down message.

Hi All I am facing an issue with our new solaris machine. in /var/adm/messages Apr 22 16:43:05 Prod-App1 in.routed: interface net0 to 172.16.101.1 turned off Apr 22 16:43:33 Prod-App1 mac: NOTICE: nxge0 link up, 1000 Mbps, full duplex Apr 22 16:43:34 Prod-App1 mac: NOTICE: nxge0 link...

LEARN ABOUT SUSE

utmpdump

UTMPDUMP(1)						Linux System Administrator's Manual					       UTMPDUMP(1)

NAME

       utmpdump - dump UTMP and WTMP files in raw format

SYNOPSIS

       utmpdump [-froh] filename

DESCRIPTION

       utmpdump is a simple program to dump UTMP and WTMP files in raw format, so they can be examined.

OPTIONS

       -f     output appended data as the file grows.

       -r     reverse. Write back edited login information into utmp or wtmp files.

       -o     use old libc5 format.

       -h     usage information.

       utmpdump  can  be  useful  in  cases  of corrupted utmp or wtmp entries.  It can dump out utmp/wtmp to an ASCII file, then that file can be
       edited to remove bogus entries and reintegrated, using

	   utmpdump -r < ascii file > wtmp

       but be warned as utmpdump was written for debugging purpose only.

BUGS

       You may not use the option -r as the format for the utmp/wtmp files strongly depends on the input format. This tool  was  not  written  for
       normal use but for debugging.

AUTHOR

       Michael Krapp

SEE ALSO

       last(1), w(1), who(1), utmp(5),

								  Februar 8, 2010						       UTMPDUMP(1)