asked on

utmpx wtmpx not showing recent entries

Have a puzzling issue here. I have some Sol 7/8 computers that are having a problem when I issue a "last -20" command. Some of the boxes report entries starting 6 months ago and others report nothing just "wtmp begins Mon Jun 15 06:40" (or some other date in the past).

I've looked at /var/adm/*tmpx and done a strings on them. They are being modified with new date (mod date changes) and I can see the new logins in the file when I do a strings on them. Any ideas?

--- Micah

ASKER CERTIFIED SOLUTION

chris_calabrese

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

emrehayretci

IT should be related with your audit settings. It is possible to activate them. If you are using the default settings, then the problem should be related with the file itself. It may be corrupted.

Delete it and create it with touch again.

micahman

ASKER

As the wtpmx and utmpx files are not test files and, from what I have read, can corrupt the OS if removed improperly, I'd rather not just delete these files randomly and hope that they come back and all is well. Has anyone had experience with this? Anyone know where there are docs that explain this process? I have searched Sun's and many other sites and found nothing that relates to this process.

chris_calabrese

It won't corrupt the OS, but it will confuse things like last and who. That's why you need to reboot afterwards to wipe the slate clean.

micahman

ASKER

Finally got a chance to test this out on one of the servers. Worked like a charm. Thanks!