Re: wtmp filling up

From: Tom Wood (twood_at_rezlink.com)
Date: 05/23/05

  • Next message: Mark Ray: "Re: wtmp filling up" 
    Date:         Mon, 23 May 2005 14:03:27 -0400
To: aix-l@Princeton.EDU

    Lamar,

    I have about 35k entries like this:
    oracle 6 38450 0000 0000 1116870802 netmeeting.ag
    g-i Mon May 23 13:53:22 EDT 2005
    oracle 6 20236 0000 0000 1116870803 netmeeting.ag
    g-i Mon May 23 13:53:23 EDT 2005
    oracle 6 38452 0000 0000 1116870803 netmeeting.ag
    g-i Mon May 23 13:53:23 EDT 2005
    oracle 6 36158 0000 0000 1116870803 netmeeting.ag
    g-i Mon May 23 13:53:23 EDT 2005
    oracle 6 36160 0000 0000 1116870803 netmeeting.ag
    g-i Mon May 23 13:53:23 EDT 2005
    oracle 6 54388 0000 0000 1116870803 netmeeting.ag
    g-i Mon May 23 13:53:23 EDT 2005
    oracle 6 36164 0000 0000 1116870803 netmeeting.ag
    g-i Mon May 23 13:53:23 EDT 2005
    oracle 6 54392 0000 0000 1116870803 netmeeting.ag
    g-i Mon May 23 13:53:23 EDT 2005
    oracle 6 54394 0000 0000 1116870804 netmeeting.ag
    g-i Mon May 23 13:53:24 EDT 2005
    oracle 6 54396 0000 0000 1116870804 netmeeting.ag
    g-i Mon May 23 13:53:24 EDT 2005

    I’m having someone try to determine what is going on with the w2k host ‘netmeeting.agg-inc’. It has been used for quite a while as the host for Quest Software’s Spotlight on Oracle application, so it has a legitimate need to connect to this machine, but I’m not sure why all of a sudden it is attempting to connect some often.

    Thanks for the command.

    Tom

    -----Original Message-----
    From: Lamar.Saxon@americredit.com [mailto:Lamar.Saxon@americredit.com]
    Sent: Monday, May 23, 2005 1:45 PM
    To: twood@rezlink.com; aix-l@Princeton.EDU
    Subject: RE: wtmp filling up

    To format wtmp for readability you need to use the fwtmp command, not the tail command like:

    /usr/lib/acct/fwtmp < /var/adm/wtmp

    Send the output of that for further analysis...

    Lamar

    From: IBM AIX Discussion List [mailto:aix-l@Princeton.EDU] On Behalf Of Tom Wood
    Sent: Monday, May 23, 2005 11:45 AM
    To: aix-l@Princeton.EDU
    Subject: wtmp filling up
    My /var/adm/wtmp file is increasing in size very fast – 246 in about 15 minutes (from a > /var/adm/wtmp command).

    File wtmp shows the file is a text file, but is it a special format? When I attempt to tail –f it, this is what I get:

    aixdb:/var/adm# tail -f wtmp
    Bønetmeeting.agg-ioraclej
                              Bønetmeeting.agg-ioraclejBønetmeeting.agg-ioracle.øj
                                                                                  B.
    Bnetmeeting.agg-ioracle.
                             Bnetmeeting.agg-ioracleFBnetmeeting.agg-ioracleFBneê

    I recognize the ‘netmeeting.agg-I’ as part of a w2k machine name, and oracle may be the user attempting to connect, but what/where is the other ‘stuff’ coming from?

    Thanks.

    Tom

    ********************************************************************************************
    IMPORTANT: The information contained in this message is privileged and confidential. It
    is intended only for the use of the individual or entity named above. If the
    reader of this message is not the intended recipient, any dissemination or
    reproduction of it is strictly prohibited. If you have received this communication
    in error, please contact us at postmaster@Rezlink.com immediately.
    Thank you.
    ********************************************************************************************

    ********************************************************************************************
    IMPORTANT: The information contained in this message is privileged and confidential. It
    is intended only for the use of the individual or entity named above. If the
    reader of this message is not the intended recipient, any dissemination or
    reproduction of it is strictly prohibited. If you have received this communication
    in error, please contact us at postmaster@Rezlink.com immediately.
    Thank you.
    ********************************************************************************************

  • Next message: Mark Ray: "Re: wtmp filling up"

    Relevant Pages

    • Re: wtmp filling up
      ... it will give you a structure of the wtmp file. ... Subject: wtmp filling up ... Thanks for the command. ... reader of this message is not the intended recipient, ...
      (AIX-L)
    • Re: wtmp filling up
      ... Subject: wtmp filling up ... Tom Wood ... Thanks for the command. ... reader of this message is not the intended recipient, any dissemination ...
      (AIX-L)