I got the following error message when running the "last" command at
my Solaris 10 server :

   # last
   /var/adm/wtmpx: Value too large for defined data type

Looks like my "wtmpx" file has reached its size limit :

   # ls -lt wtmpx
   -rw-r--r--   1 adm      adm      2150910511 May 12 19:15 wtmpx


Can one reduce the size of wtmpx ? If yes, how ?  I would like to at
least get some information out of the wtmpx file before I zero it out
and find ways to prevent it from reaching this big in future.

Thanks,

Bill

In <8ea955d6-3ba9-48b9-b05e-697b670f0853@v26g2000prm.googlegroups.com> underh20.scubadiving@gmail.com writes:

>I got the following error message when running the "last" command at
>my Solaris 10 server :

>   # last
>   /var/adm/wtmpx: Value too large for defined data type

>Looks like my "wtmpx" file has reached its size limit :

>   # ls -lt wtmpx
>   -rw-r--r--   1 adm      adm      2150910511 May 12 19:15 wtmpx

>Can one reduce the size of wtmpx ? If yes, how ?  I would like to at
>least get some information out of the wtmpx file before I zero it out
>and find ways to prevent it from reaching this big in future.

Yes, you can do that in a number of ways.  `dd' works, but you have to
know that the record size in that file is 372.  You have to copy
multiples of that record size.  Something like this will extract the
second record, for example:

    $ dd bs=372 count=1 skip=1 if=wtmpx | od -c

In your case, there's 2150910511/372 = 5782017 records.  With the
proper options to `dd', you can copy parts of the file.  It's much
quicker if you multiply the blocksize by some moderate number and
divide the others by the same number.

-- 
-Gary Mills-    -Unix Support-    -U of M Academic Computing and Networking-

On May 13, 1:32=A0am, underh20.scubadiv...@gmail.com wrote:
> I got the following error message when running the "last" command at
> my Solaris 10 server :
>
> =A0 =A0# last
> =A0 =A0/var/adm/wtmpx: Value too large for defined data type
>
>
> Can one reduce the size of wtmpx ? If yes, how ? =A0I would like to at
> least get some information out of the wtmpx file before I zero it out
> and find ways to prevent it from reaching this big in future.
>

Hi Bill

You can use /usr/lib/acct/fwtmp for this. See fwtmp(1M).

To e.g. create a new wtmpx containing only the last 1000 records of
your old one, do:

/usr/lib/acct/fwtmp < wtmpx | tail -1000 \
| /usr/lib/acct/fwtmp -ic > /tmp/wmtpx.new


Hope that helps,
Christian

--
rc at networkz dot ch

underh20.scubadiving@gmail.com schrieb:
> I got the following error message when running the "last" command at
> my Solaris 10 server :
> 
>    # last
>    /var/adm/wtmpx: Value too large for defined data type
> 
> Looks like my "wtmpx" file has reached its size limit :
> 
>    # ls -lt wtmpx
>    -rw-r--r--   1 adm      adm      2150910511 May 12 19:15 wtmpx
> 
> 
> Can one reduce the size of wtmpx ? If yes, how ?  I would like to at
> least get some information out of the wtmpx file before I zero it out
> and find ways to prevent it from reaching this big in future.
> 
> Thanks,
> 
> Bill

is it really as big as ls -lt says? what show ls -s?
wtmpx is a "file with wholes" and the "size" depends on the highest uid.
do you have 32bit Solaris (isainfo)?

In article <482c8fb7$0$6517$9b4e6d93@newsspool4.arcor-online.net>,
	Wolfgang <wtrappe@AT.web.de> writes:
> underh20.scubadiving@gmail.com schrieb:
>> I got the following error message when running the "last" command at
>> my Solaris 10 server :
>> 
>>    # last
>>    /var/adm/wtmpx: Value too large for defined data type
>> 
>> Looks like my "wtmpx" file has reached its size limit :
>> 
>>    # ls -lt wtmpx
>>    -rw-r--r--   1 adm      adm      2150910511 May 12 19:15 wtmpx
>> 
>> 
>> Can one reduce the size of wtmpx ? If yes, how ?  I would like to at
>> least get some information out of the wtmpx file before I zero it out
>> and find ways to prevent it from reaching this big in future.
>
> is it really as big as ls -lt says? what show ls -s?
> wtmpx is a "file with wholes" and the "size" depends on the highest uid.
> do you have 32bit Solaris (isainfo)?

That's /var/adm/lastlog you're describing.
wtmpx(4) just grows forever.

last(1) seems not to be LARGEFILE aware in nm(1) output,
and isn't listed as LARGEFILE aware in largefile(5).

-- 
Andrew Gabriel
[email address is not usable -- followup in the newsgroup]

underh20.scubadiving@gmail.com wrote:
> Can one reduce the size of wtmpx ? If yes, how ?  I would like to at
> least get some information out of the wtmpx file before I zero it out
> and find ways to prevent it from reaching this big in future.

If you enable accounting it will manage the file as a side effect.

-- 
Gods I don't believe in: http://anya.sighup.org.uk/gods.html

Andrew Gabriel schrieb:
> In article <482c8fb7$0$6517$9b4e6d93@newsspool4.arcor-online.net>,
> 	Wolfgang <wtrappe@AT.web.de> writes:
>> underh20.scubadiving@gmail.com schrieb:
>>> I got the following error message when running the "last" command at
>>> my Solaris 10 server :
>>>
>>>    # last
>>>    /var/adm/wtmpx: Value too large for defined data type
>>>
>>> Looks like my "wtmpx" file has reached its size limit :
>>>
>>>    # ls -lt wtmpx
>>>    -rw-r--r--   1 adm      adm      2150910511 May 12 19:15 wtmpx
>>>
>>>
>>> Can one reduce the size of wtmpx ? If yes, how ?  I would like to at
>>> least get some information out of the wtmpx file before I zero it out
>>> and find ways to prevent it from reaching this big in future.
>> is it really as big as ls -lt says? what show ls -s?
>> wtmpx is a "file with wholes" and the "size" depends on the highest uid.
>> do you have 32bit Solaris (isainfo)?
> 
> That's /var/adm/lastlog you're describing.
> wtmpx(4) just grows forever.
> 
> last(1) seems not to be LARGEFILE aware in nm(1) output,
> and isn't listed as LARGEFILE aware in largefile(5).
> 

you are right, sorry, its lastlog. But I irritated by the "Looks like my 
"wtmpx" file has reached its size limit", which has to be "the file has 
reached the size limit of last(1)".