Fixing wtmp Errors

The wtmp files sometimes cause problems in the day-to-day operation of the accounting system. When the date is changed and the system is in multiuser state, a set of date change records is written into /var/adm/wtmp. The wtmpfix program is designed to adjust the timestamps in the wtmp records when a date change is encountered. However, some combinations of date changes and reboots may slip through wtmpfix and cause acctcon to fail.

To patch up a wtmp file:

1. Change to the directory /var/adm/acct/nite.

2. To convert the corrupted binary record to a formatted ASCII form, execute:
   
   fwtmp < wtmp.MMDD > xwtmp

   where MMDD is the numeric date suffix of the file you want to patch.

3. Edit the file xwtmp and delete corrupted records or delete all records from the beginning up to the date change.

4. Write and quit the file xwtmp.

5. To convert the patched file back to the binary form needed by the accounting utilities, execute
   
   fwtmp -ic < xwtmp > wtmp.MMDD

6. If the wtmp file is beyond repair, create a null wtmp file. The existence of this null file prevents any charging of connect time. As a side effect, the lack of a wtmp file prevents acctprc from identifying the login that owned a particular process. When this happens, the process is charged to the owner of the first login in the password file for the appropriate user ID.