How big is the wtmpx file? If it is very near 2Gb, it it too big.
Is (or was) the disc partition containing the wtmpx file full?
Is the output from "who -u" correct (it comes from the utmpx file) ?
There is a known bug in Solaris if the hardware realtime clock was wrong (or had a flat battery) at the time the system was booted. Correcting the time with the unix "date" command is not enough.
"Piping to a file"? sounds unlikely.
Something like this (assuming /var/tmp has enough space).
Then look at the early records to see how long this file has been in use.
There is no automatic cleanup process, you need to write one.
I normally start a new wtmpx file each week and keep 8 weeks worth.
Some sites would require more history, but bear in mind that once a wtmpx file gets to be a year old, the output from commands like "last" can be nonsense.
When starting a new file, copy the old file to a new name with "cp -p" and then null the wtmpx file (only) with ">wtmpx". Do not rename the wtmpx file or you will have to create a new file and fix the permissions and stop/start the accounting process.
Do not touch the utmpx file. If you null that one you will have to reboot the server to fix the problem.
Do someone know how to delete entry(some lines)
in file "wtmpx" that command "last" use it.
this file is binary so I cannot edit directy.
=========================
#last
root pts/1 noc Fri Mar 3 22:04 still logged in
root pts/1 noc Fri Mar 3 22:01 - 22:02 ... (4 Replies)
Hello everybody:
the wtmpx file on my Sol8 machine, got so big (2GB), that my root partition is almost full now, can I empty that file, I read about it that it contains database of user access and auditing, so in case I emptied it will it affect my system??
Thanks alot (3 Replies)
Hi,
I am using Sun Solaris 5.9 OS. I have found a file called wtmpx having a size of 5.0 GB. I want to clear this file using :>/var/adm/wtmpx. My query is, would it cause any problem to the running live system.
Could anyone suggest the best method to clear the file without causing problem to... (6 Replies)
Hi
in my solaris 9 system wmptx file is not updating so it is not recording any login or logout or any other entry.
can any one tell me how to solve this problem (0 Replies)
Hi, saw couple threads about wtmpx corruption, I had this problem on many servers, last command was not working or displaying old output, found good information on a thread on this site and wrote a perl script to fix, thought it might help some people.
I found that using wtmpfix I lost many... (0 Replies)
Hi all,
I have F5 load balancer on my system and checking service status by opening an ftp session in every 30 seconds. These ftp sessions are being logged in /var/adm/wtmpx and filling up the file. when i run the last command most of the output is this ftp session. I was wondering if there is a... (1 Reply)
hi,
we have a solaris 10 box that was handled by a different sysadmin before & now it is turned over to us for system administration. our concern is that if we issue the "last" command, it usually says "wtmp begins current day current month date 02:30". just like this "wtmp begins Thu Mar 7... (6 Replies)
Hi all,
I have been tasked to change permissions on the wtmpx file to 640. Currently the permissions are at 644. My question is will anything be affected if I change the permissions as shown? Thanks in advance.
Derek (2 Replies)
Hi,
I tried running the command "last" in the server to check the users that were last logged into the system.
However, I get this error :
root@csidblog:# last
/var/adm/wtmpx: Value too large for defined data type
How do I proceed to get this info?
I read some forums suggesting to use... (2 Replies)