IBM Support

How to fix wtmp file for last command

How To


Summary

The /var/adm/wtmp file collects login and logout records used by system accounting. If this file becomes corrupted, there are two methods that might fix the file.

Objective

Describe how to use wtmpfix and fwtmp to fix the /var/adm/wtmp file.

Steps

A. Attempt to repair the wtmp file with wtmpfix.

1) Use the wtmpfix command to try to fix any invalid entries.
# /usr/sbin/acct/wtmpfix < /var/adm/wtmp > /tmp/wtmp.bin.fix

2) Convert the fixed binary wtmp file to an ASCII file.
# /usr/sbin/acct/fwtmp < /tmp/wtmp.bin.fix >/tmp/wtmp.ascii.post

3) If /tmp/wtmp.ascii.post is correct you can replace /var/adm/wtmp with the new binary file.
# mv /var/adm/wtmp /var/adm/wtmp.old
# mv /tmp/wtmp.bin.fix /var/adm/wtmp
# chmod 664 /var/adm/wtmp
# chown adm:adm /var/adm/wtmp

B. Manually repair the wtmp file.
If Option A (wtmpfix) did not resolve the errors, you can try to correct the data.

1) Convert the binary wtmp file to an ASCII file.
# /usr/sbin/acct/fwtmp < /var/adm/wtmp >/tmp/wtmp.ascii.pre

2) Edit the ASCII file to remove any invalid records.
# vi /tmp/wtmp.ascii.pre

3) Convert the ASCII wtmp.new file back to binary format.
# /usr/sbin/acct/fwtmp  -ic < /tmp/wtmp.ascii.pre  > /tmp/wtmp.bin.fix

4) Replace /var/adm/wtmp with the new binary file.
# mv /var/adm/wtmp /var/adm/wtmp.old
# mv /tmp/wtmp.bin.fix /var/adm/wtmp
# chmod 664 /var/adm/wtmp
# chown adm:adm /var/adm/wtmp

5) Check the new wtmp with preferred options.
# last
# /usr/sbin/acct/fwtmp < /var/adm/wtmp >/tmp/wtmp.ascii.post

C. Clear the file if it cannot be repaired.
1) If the wtmp file is corrupted beyond repair, you can clear the file.
# /usr/sbin/acct/nulladm /var/adm/wtmp

Additional Information

SUPPORT

If you require more assistance, use the following step-by-step instructions to contact IBM to open a case for software with an active and valid support contract.  

1. Document (or collect screen captures of) all symptoms, errors, and messages related to your issue.

2. Capture any logs or data relevant to the situation.

3. Contact IBM to open a case:

   -For electronic support, see the IBM Support Community:
     https://www.ibm.com/mysupport
   -If you require telephone support, see the web page:
      https://www.ibm.com/planetwide/

4. Provide a clear, concise description of the issue.

 - For guidance, see: Working with IBM AIX Support: Describing the problem.

5. If the system is accessible, collect a system snap, and upload all of the details and data for your case.

 - For guidance, see: Working with IBM AIX Support: Collecting snap data

[{"Line of Business":{"code":"LOB08","label":"Cognitive Systems"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG10","label":"AIX"},"ARM Category":[{"code":"a8m0z000000cvzhAAA","label":"Security"}],"ARM Case Number":"TS004157351","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]

Document Information

More support for:
AIX

Component:
Security

Software version:
All Version(s)

Document number:
6327195

Modified date:
26 October 2023

UID

ibm16327195

Manage My Notification Subscriptions

Page Feedback