Tech Support > Operating Systems > UNIX / Variants > LAST command fails due to huge wtmpx in Solaris 10
LAST command fails due to huge wtmpx in Solaris 10
Posted by underh20.scubadiving@gmail.com on May 12th, 2008


I got the following error message when running the "last" command at
my Solaris 10 server :

# last
/var/adm/wtmpx: Value too large for defined data type

Looks like my "wtmpx" file has reached its size limit :

# ls -lt wtmpx
-rw-r--r-- 1 adm adm 2150910511 May 12 19:15 wtmpx


Can one reduce the size of wtmpx ? If yes, how ? I would like to at
least get some information out of the wtmpx file before I zero it out
and find ways to prevent it from reaching this big in future.

Thanks,

Bill

Posted by Gary Mills on May 13th, 2008


In <8ea955d6-3ba9-48b9-b05e-697b670f0853@v26g2000prm.googlegroups.com> underh20.scubadiving@gmail.com writes:

Yes, you can do that in a number of ways. `dd' works, but you have to
know that the record size in that file is 372. You have to copy
multiples of that record size. Something like this will extract the
second record, for example:

$ dd bs=372 count=1 skip=1 if=wtmpx | od -c

In your case, there's 2150910511/372 = 5782017 records. With the
proper options to `dd', you can copy parts of the file. It's much
quicker if you multiply the blocksize by some moderate number and
divide the others by the same number.

--
-Gary Mills- -Unix Support- -U of M Academic Computing and Networking-

Posted by rc on May 13th, 2008


On May 13, 1:32*am, underh20.scubadiv...@gmail.com wrote:
Hi Bill

You can use /usr/lib/acct/fwtmp for this. See fwtmp(1M).

To e.g. create a new wtmpx containing only the last 1000 records of
your old one, do:

/usr/lib/acct/fwtmp < wtmpx | tail -1000 \
| /usr/lib/acct/fwtmp -ic > /tmp/wmtpx.new


Hope that helps,
Christian

--
rc at networkz dot ch


Posted by Wolfgang on May 15th, 2008


underh20.scubadiving@gmail.com schrieb:
is it really as big as ls -lt says? what show ls -s?
wtmpx is a "file with wholes" and the "size" depends on the highest uid.
do you have 32bit Solaris (isainfo)?

Posted by Andrew Gabriel on May 16th, 2008


In article <482c8fb7$0$6517$9b4e6d93@newsspool4.arcor-online.net>,
Wolfgang <wtrappe@AT.web.de> writes:
That's /var/adm/lastlog you're describing.
wtmpx(4) just grows forever.

last(1) seems not to be LARGEFILE aware in nm(1) output,
and isn't listed as LARGEFILE aware in largefile(5).

--
Andrew Gabriel
[email address is not usable -- followup in the newsgroup]

Posted by Geoff Lane on May 16th, 2008


underh20.scubadiving@gmail.com wrote:
If you enable accounting it will manage the file as a side effect.

--
Gods I don't believe in: http://anya.sighup.org.uk/gods.html


Similar Posts