Issue with 'last' command

jdod23

Hi all,
I have a problem with 'last' command not displaying recent logins on Solaris 10 zone.
Basically there are users logging into the system on daily basis but the last login recorded is on Aug 4, over 6 weeks ago.
I checked /var/adm/wtmpx file permission and it looks ok (644 permission, adm user and group)
Time stamp on file is updated on every login, /var/ file system has plenty of free space.

Any ideas how to fix this issue?

jdod23

Ok, got is sorted sooner then expected
Turned out the /var/adm/wtmpx file got corrupted.

Here is what I did to fix it, in case you ever need it:
1) backup log file

cp /var/adm/wtmpx /var/adm/wtmpx.backup

2) use wtmpfix command to recover corrupted file, save in temporary file

/usr/lib/acct/wtmpfix /var/adm/wtmpx > /var/adm/wtmpx.tmp

This is the output I got:
/usr/lib/acct/wtmpfix /var/adm/wtmpx > /var/adm/wtmpx.tmp
/var/adm/wtmpx: offset 194928: file ends in mid-record
/var/adm/wtmpx: offset 194928: suspecting misaligned records, repositioning
/var/adm/wtmpx: offset 68052: starting re-scan
/var/adm/wtmpx: offset 74748: now recognizing aligned records again
/var/adm/wtmpx: offset 195276: EOF reached after recovering from corruption in the middle of the file. This file may need to be repaired by hand.

3) at this stage you can check temporary file

last -f wtmpx.tmp | more

4) if output of above command is what you expect move temporary file back to original

mv /var/adm/wtmpx.tmp /var/adm/wtmpx

Standard Toaster

Cheers for the update, handy one that.