Hi,
I tried running the command "last" in the server to check the users that were last logged into the system.
However, I get this error :
root@csidblog:[/]# last
/var/adm/wtmpx: Value too large for defined data type
How do I proceed to get this info?
I read some forums suggesting to use the fwtmp tool, however, I/my company does not have official login to the Oracle website to download the package.
It is quite important.
Assuming you are on solaris:
Can you write C code? getutxent -
man pages section 3: Basic Library Functions
provides a list of solaris calls to do what you need.
When you ask for help please tell us:
This is certainly Solaris (Oracle means Solaris!).
And indeed this seems to be a FAQ, because the last command in Solaris is 32-bit, compiled without largefile support.
If the file reaches 2 GB size, it gets stuck...
Also there is no logrotation defined by default.
The problem is in Solaris 10 and older (don't know if it's solved in Solaris 11).
By experimenting I found a temporary fix: skip the oldest 100 entries:
dd if=/var/adm/wtmpx bs=744 skip=100 of=/var/adm/wtmpx.tmp
last -f /var/adm/wtmpx.tmp
If it works, copy the fixed file back
cp /var/adm/wtmpx.tmp /var/adm/wtmpx
rm /var/adm/wtmpx.tmp
How to add this to log rotation:
Solaris 9 and 10 (maybe Solaris 11?):
add the following line to /etc/logadm.conf
/var/adm/wtmpx -C 12 -c -p 1m -s 10m
or run the following command:
logadm -w /var/adm/wtmpx -C 12 -c -p 1m -s 10m
From now on it will every month check if the file is bigger than 10 MB and eventually rotate it to wtmpx.0 wtmpx.1 ... wtmpx.11.
To look at a rotated file, say wtmpx.0, you simply do
last -f /var/adm/wtmpx.0
For Solaris 8 you could append something to its rotation script /usr/lib/newsyslog...