- LAST command fails due to huge wtmpx in Solaris 10
- Posted by underh20.scubadiving@gmail.com on May 12th, 2008
I got the following error message when running the "last" command at
my Solaris 10 server :
# last
/var/adm/wtmpx: Value too large for defined data type
Looks like my "wtmpx" file has reached its size limit :
# ls -lt wtmpx
-rw-r--r-- 1 adm adm 2150910511 May 12 19:15 wtmpx
Can one reduce the size of wtmpx ? If yes, how ? I would like to at
least get some information out of the wtmpx file before I zero it out
and find ways to prevent it from reaching this big in future.
Thanks,
Bill
- Posted by Gary Mills on May 13th, 2008
In <8ea955d6-3ba9-48b9-b05e-697b670f0853@v26g2000prm.googlegroups.com> underh20.scubadiving@gmail.com writes:
Yes, you can do that in a number of ways. `dd' works, but you have to
know that the record size in that file is 372. You have to copy
multiples of that record size. Something like this will extract the
second record, for example:
$ dd bs=372 count=1 skip=1 if=wtmpx | od -c
In your case, there's 2150910511/372 = 5782017 records. With the
proper options to `dd', you can copy parts of the file. It's much
quicker if you multiply the blocksize by some moderate number and
divide the others by the same number.
--
-Gary Mills- -Unix Support- -U of M Academic Computing and Networking-
- Posted by rc on May 13th, 2008
On May 13, 1:32*am, underh20.scubadiv...@gmail.com wrote:
Hi Bill
You can use /usr/lib/acct/fwtmp for this. See fwtmp(1M).
To e.g. create a new wtmpx containing only the last 1000 records of
your old one, do:
/usr/lib/acct/fwtmp < wtmpx | tail -1000 \
| /usr/lib/acct/fwtmp -ic > /tmp/wmtpx.new
Hope that helps,
Christian
--
rc at networkz dot ch
- Posted by Wolfgang on May 15th, 2008
underh20.scubadiving@gmail.com schrieb:
is it really as big as ls -lt says? what show ls -s?
wtmpx is a "file with wholes" and the "size" depends on the highest uid.
do you have 32bit Solaris (isainfo)?
- Posted by Andrew Gabriel on May 16th, 2008
In article <482c8fb7$0$6517$9b4e6d93@newsspool4.arcor-online.net>,
Wolfgang <wtrappe@AT.web.de> writes:
That's /var/adm/lastlog you're describing.
wtmpx(4) just grows forever.
last(1) seems not to be LARGEFILE aware in nm(1) output,
and isn't listed as LARGEFILE aware in largefile(5).
--
Andrew Gabriel
[email address is not usable -- followup in the newsgroup]
- Posted by Geoff Lane on May 16th, 2008
underh20.scubadiving@gmail.com wrote:
If you enable accounting it will manage the file as a side effect.
--
Gods I don't believe in: http://anya.sighup.org.uk/gods.html