No utmp entry, must login from lowest level shell

[dbm7230]

I am finding that my log files are filling up and I don't know why. Today the root filesystem filled and I ran /etc/cleanup but within minutes my users started getting "No utmp entry, must login from lowest level shell". I rebooted the server and the users were able to login. However I notice that the root filesystem is still growing slowly. Can anyone tell me what's going on.

 

[jaubele1]

Most likely, the root partition is full. You must get into root (!SU) to clear out space.

 

[dbm7230]

Thanks so much. Yes the root filesystem is growing. Since making this post on Friday /root was at 92% and now it's at 97% full. I will find time to take it down to single user mode and cleanup root. Do you know why this happens??? And do you have any information on the file called "cleanup" located in /etc. Can running this cause corruption?

 

[dbm7230]

Oh - 1 more thing, this is the file that is growing:

# ls -l /var/opt/K/SCO/Unix/5.0.5Eb/etc/wtmpx

-rw-rw-r-- 1 adm adm 78372592 Jan 5 14:44 /var/opt/K/SCO/Unix/5.0.5
Eb/etc/wtmpx

What is this about and why is it growing? HELP!!!

 

[tshot]

wtmpx imples thta u have some remote logging going on. i.e telnet cmd. there is some issue with remote loggings
Note from search for wtmpx on

http://support.sco.com

/etc/wtmpx, which contains login history, can be truncated whilst the server is in multi-user mode. Use who -x /etc/wtmpx to view this information.
also read TA 105610 and TA 105755. at SCO





----------------
ur feedback is a very welcome desire

 

[dbm7230]

Thanks; here's what happened:

# who -x /etc/wtmpx
who: Warning --- File '/etc/wtmpx' may be corrupted

Wow - so this file is corrupted! Yikes...

After researching further, I found that I will need to perform the following steps. I hope this helps. I will let you all know! Thanks again... Any other suggestions?

-----------------------------
These files are log files. They can become zero length without affecting the system, as long as you reboot the system after truncating the files. Perform these steps:

1. Bring the system into System Maintenance mode.

2. Make copies of the files /etc/utmp, /etc/utmpx, /etc/wtmp, and
/etc/wtmpx before proceeding with the next step.

3. Delete the contents of these files by executing the following commands:

# > /etc/utmp
# > /etc/wtmp
# > /etc/utmpx
# > /etc/wtmpx


4. Shutdown the system:

# shutdown -y -g0