Today (Saturday) We will make some minor tuning adjustments to MySQL.

You may experience 2 up to 10 seconds "glitch time" when we restart MySQL. We expect to make these adjustments around 1AM Eastern Daylight Saving Time (EDT) US.

Getting information from the wtmpx file

Login or Register to Reply

Thread Tools Search this Thread
# 1  
Getting information from the wtmpx file


I tried running the command "last" in the server to check the users that were last logged into the system.
However, I get this error :

root@csidblog:[/]# last
/var/adm/wtmpx: Value too large for defined data type

How do I proceed to get this info?
I read some forums suggesting to use the fwtmp tool, however, I/my company does not have official login to the Oracle website to download the package.

It is quite important.
# 2  
Assuming you are on solaris:
Can you write C code? getutxent -
man pages section 3: Basic Library Functions

provides a list of solaris calls to do what you need.

When you ask for help please tell us:
1. OS name and version
2. shell (like bash, ksh, tcsh, ...) that you use.
# 3  
This is certainly Solaris (Oracle means Solaris!).
And indeed this seems to be a FAQ, because the last command in Solaris is 32-bit, compiled without largefile support.
If the file reaches 2 GB size, it gets stuck...
Also there is no logrotation defined by default.
The problem is in Solaris 10 and older (don't know if it's solved in Solaris 11).

By experimenting I found a temporary fix: skip the oldest 100 entries:
dd if=/var/adm/wtmpx bs=744 skip=100 of=/var/adm/wtmpx.tmp
last -f /var/adm/wtmpx.tmp

If it works, copy the fixed file back
cp /var/adm/wtmpx.tmp /var/adm/wtmpx
rm /var/adm/wtmpx.tmp

How to add this to log rotation:
Solaris 9 and 10 (maybe Solaris 11?):
add the following line to /etc/logadm.conf
/var/adm/wtmpx -C 12 -c -p 1m -s 10m

or run the following command:
logadm -w /var/adm/wtmpx -C 12 -c -p 1m -s 10m

From now on it will every month check if the file is bigger than 10 MB and eventually rotate it to wtmpx.0 wtmpx.1 ... wtmpx.11.
To look at a rotated file, say wtmpx.0, you simply do
last -f /var/adm/wtmpx.0

For Solaris 8 you could append something to its rotation script /usr/lib/newsyslog...
Login or Register to Reply

Thread Tools Search this Thread
Search this Thread:
Advanced Search

More UNIX and Linux Forum Topics You Might Find Helpful
WTMPX File corrupted
Hi All I work on solaris 8, 9 and 10 platforms and have encountered an error which is my wtmpx files appear to be corrupted as all entries contain the date 1970 (the birth of unix). Now this is obviously not the case, so my query is: 1 - Can the existing wtmpx files be manipulated to...... Solaris
wtmpx file
What could possibly happen if wtmpx file got deleted by mistake? Thanks,... Solaris
wtmpx file is too big
Hi, I am using Sun Solaris 5.9 OS. I have found a file called wtmpx having a size of 5.0 GB. I want to clear this file using :>/var/adm/wtmpx. My query is, would it cause any problem to the running live system. Could anyone suggest the best method to clear the file without causing problem to...... Solaris
wtmpx file
Hello everybody: the wtmpx file on my Sol8 machine, got so big (2GB), that my root partition is almost full now, can I empty that file, I read about it that it contains database of user access and auditing, so in case I emptied it will it affect my system?? Thanks alot... UNIX for Dummies Questions & Answers
UNIX for Dummies Questions & Answers
how to delete entry in file "wtmpx"(/var/adm/wtmpx)
Do someone know how to delete entry(some lines) in file "wtmpx" that command "last" use it. this file is binary so I cannot edit directy. ========================= #last root pts/1 noc Fri Mar 3 22:04 still logged in root pts/1 noc Fri Mar 3 22:01 - 22:02 ...... UNIX for Advanced & Expert Users
UNIX for Advanced & Expert Users

Featured Tech Videos