Re: Why might "who -r" fail?

From: Bela Lubkin (belal_at_sco.com)
Date: 02/25/04

  • Next message: Jean-Pierre Radley: "Re: P4 Xeon compatibility with 5.0.5" 
    Date: Wed, 25 Feb 2004 08:45:39 GMT
To: scomsc@xenitec.ca

    Brian K. White wrote:

    > I see a working 5.0.6 box shows a couple lines in utmp[x] that the
    > problem box does not have...
    >
    > # cwtmp -R /etc/utmp
    > u= id= l=system boot p=0 BOOT_TIME 2004-02-06
    > 04:26:09 EST trm=0 ex=0
    > u= id= l=run-level 2 p=0 RUN_LVL 2004-02-06
    > 04:26:09 EST trm=50 ex=83
    > u=root id=typ0 l=ttyp0 p=1456 USER_PROC 2004-02-24
    > 22:52:02 EST trm=0 ex=0

    The "RUN_LVL" entry is the one that `who -r` displays.

    > So what could cause that first line to fail to get written at boot on
    > the problem box?

    You've solved that.

    I just wanted to comment, all the times that you're zeroing /etc/wtmp[x]
    are unnecessary. /etc/utmp[x] are the active files that are written by
    various utilities (init, getty, login, telnetd, rlogind, sshd, xterm,
    etc.), and read by others (who, w, finger, etc.) The wtmp files are
    logs of entries that at some point existed in the utmp files. The main
    consumers of wtmp are last & some of the acct(ADM) family of commands.

    There is one situation where it's good to zero wtmp[x]: if they're
    corrupt. If they've lost their proper record structure, future appended
    records aren't readable by standard OS utilities (I don't know if
    `cwtmp` can decode that sort of corruption).

    The author of `cwtmp` has 5 years worth of wtmp records saved on his
    system (in a series of history files), allowing him to analyze past user
    activity and detect long term subtle patterns. (If he writes suitable
    analysis software...)

    >Bela<

  • Next message: Jean-Pierre Radley: "Re: P4 Xeon compatibility with 5.0.5"