Re: wtmp filling up

From: Lamar Saxon (Lamar.Saxon_at_AMERICREDIT.COM)
Date: 05/23/05

  • Next message: Tom Wood: "Re: wtmp filling up" 
    Date:         Mon, 23 May 2005 12:45:03 -0500
To: aix-l@Princeton.EDU

    To format wtmp for readability you need to use the fwtmp command, not the tail command like:

    /usr/lib/acct/fwtmp < /var/adm/wtmp

    Send the output of that for further analysis...

    Lamar

      _____

    From: IBM AIX Discussion List [mailto:aix-l@Princeton.EDU] On Behalf Of Tom Wood
    Sent: Monday, May 23, 2005 11:45 AM
    To: aix-l@Princeton.EDU
    Subject: wtmp filling up

    My /var/adm/wtmp file is increasing in size very fast - 246 in about 15 minutes (from a > /var/adm/wtmp command).

    File wtmp shows the file is a text file, but is it a special format? When I attempt to tail -f it, this is what I get:

    aixdb:/var/adm# tail -f wtmp
    BÒønetmeeting.agg-ioraclej
                              BÒønetmeeting.agg-ioraclejBÒønetmeeting.agg-ioracle.øj
                                                                                  B.
    BÒnetmeeting.agg-ioracle.
                             BÒnetmeeting.agg-ioracleFBÒnetmeeting.agg-ioracleFBÒneê

    I recognize the 'netmeeting.agg-I' as part of a w2k machine name, and oracle may be the user attempting to connect, but what/where is the other 'stuff' coming from?

    Thanks.

    Tom



    ********************************************************************************************
    IMPORTANT: The information contained in this message is privileged and confidential. It
    is intended only for the use of the individual or entity named above. If the
    reader of this message is not the intended recipient, any dissemination or
    reproduction of it is strictly prohibited. If you have received this communication
    in error, please contact us at postmaster@Rezlink.com immediately.
    Thank you.
    ********************************************************************************************

    Privileged and Confidential. This e-mail, and any attachments there to, is intended only for use by the addressee(s) named herein and may contain privileged or confidential information. If you have received this e-mail in error, please notify me immediately by a return e-mail and delete this e-mail. You are hereby notified that any dissemination, distribution or copying of this e-mail and/or any attachments thereto, is strictly prohibited.

  • Next message: Tom Wood: "Re: wtmp filling up"