Subject: Problem w/ Solaris /var/adm/wtmpx and /usr/bin/last(1)

From: Greg Bulman - EST Contractor <[email-masked]>
Date: Mon, 8 Mar 1999 18:16:45 -0800

I'm running wu-ftpd 2.4.2, built and running under Solaris 2.5.1.

/usr/bin/last doesn't show the ftp sessions correctly.  The session
closes aren't updated in the accounting file correctly.  A new ftp
session logs the previous session as closed.  As a result you only 
see one ftp session as "still logged in", and the time elapsed fields
are completely useless.

I tried it in several Beta versions with the same incorrect results.

It does seem particular to Solaris.  The same src code works fine built
and running under SunOS 4.x, and IRIX 6.2.

Before I file a bug report I'd like to verify these results with others.
Has anyone seen wu-ftpd 2.4.x work under Solaris 2.x?

Thanks in Advance,
-gbulman
--------------------------------------------------------------------------------
Greg Bulman						[email-masked]
UNIX Systems Administrator
Synopsys, Inc.
--------------------------------------------------------------------------------

---

From: "Scott Parmenter" <[email-masked]>
Date: Mon, 08 Mar 1999 18:57:28 -0800

> Before I file a bug report I'd like to verify these results with others.

Hadn't looked before now, but it looks like I get the same thing under TSOL 2.5.1.
In fact, a quick Netscape connection didn't get recorded at all.  The account that
was at the top of the list who had logged out previous to the Netscape test was
still marked as logged in afterwards.  Does this have something to do with the
duration of the connections?

Scott

---

From: Greg Bulman - EST Contractor <[email-masked]>
Date: Tue, 9 Mar 1999 09:11:31 -0800

Now running and testing ...
FTP server (Version wu-2.4.2-VR16(1) Tue Mar 9 08:21:34 PST 1999)
 
Let me apologize in advance for being curt, I've just been over this so many
times with other ftp server administrators and they always say it logs
correctly.  That is, until I ask them why they only show 1 ftp session active
at any given time.  Upon closer inspection and in conjuction with ftpcount they
finally say its broken.  So please check these results carefully before
reporting back.
 
I have compiled the the VR16 ftpd and it indeed does have a bug with writing
/var/adm/wtmpx entries, i.e. last does *not* work.  I have tried this new
binary under Solaris 2.5.1 and 2.7.   Please note, in each case I have even
rebooted and in /etc/rc2.d I ran a script which did the suggested ...
cat /dev/null > /var/adm/wtmp
cat /dev/null > /var/adm/wtmpx
So there is no chance that previous tests left me with a corrupted wtmpx file.
 
Please note testers ... back in wu-ftpd 2.4 the wtmpx entries weren't even
being created ... the src still pointed to the incorrect SunOS 4.x accounting
files.  In 2.4.2 Beta versions is starting logging to the correct accounting
file. However, testers, please note ... yes you see "ftp" entries with the last
command but the entries are *incorrect*.  Do you ever see two ftp sessions
"still logged in".  The answer is no.  See below an sample session.  I ran last
from ftpserver 3 times, 1 time after clean wtmpx and reboot and just logging
in.  Next after an ftp session from myhost.  Note I did not exit this ftp
session.  3rd, last shows me ftping in from otherhost at which point this
2nd ftp session logged my first ftp session as finished in the accounting
file when I actually in fact have two active ftp sessions running.
 
This behaviour *is* in (Version wu-2.4.2-VR16.   And only in Solaris.  This
all seems to work just fine in SunOS and IRIX although I must admit I haven't
yet tried VR16 under these OS's simply because they weren't broken before.
 
ftpserver[28]% last|head
gbulman   pts/0        myhost           Tue Mar  9 08:31   still logged in
 
wtmp begins Tue Mar  9 08:31
ftpserver[29]% last
ftp       ftp          myhost           Tue Mar  9 08:31   still logged in
gbulman   pts/0        myhost           Tue Mar  9 08:31   still logged in
 
wtmp begins Tue Mar  9 08:31
ftpserver[30]% last
ftp       ftp          otherhost        Tue Mar  9 08:31   still logged in
ftp       ftp          myhost           Tue Mar  9 08:31 - 08:31  (00:00)
gbulman   pts/0        myhost           Tue Mar  9 08:31   still logged in
 
wtmp begins Tue Mar  9 08:31
ftpserver[31]%
 
-gbulman

> 
> On Tue, 9 Mar 1999, Tommaso Centro wrote:
> 
> > Date: Tue, 09 Mar 1999 10:03:45 +0100
> > From: Tommaso Centro <[email-masked]>
> > To: [email-masked]
> > Subject: Re: Problem w/ Solaris /var/adm/wtmpx and /usr/bin/last(1)
> > 
> > James McMahon wrote:
> > > 
> > > I just did a quick test on a system running Solaris 2.6 and wu-ftpd 2.4.2 
beta
> > > 18 VR 11 and found the same.  Last indicated that the existing connection 
had
> > > been closed and left one connection open when there were definately 2.
> > > 
> > > James
> > > 
> > > Scott Parmenter wrote:
> > > 
> > > > Hadn't looked before now, but it looks like I get the same thing under 
TSOL
> > > > 2.5.1.
> > > > was at the top of the list who had logged out previous to the Netscape 
test
> > > > was
> > > > still marked as logged in afterwards.  Does this have something to do 
with
> > > > the
> > I don't know if it matters but i'm using ftpd (default daemon) with
> > Solaris 2.7 and i get exactly the same problem with "last".
> 
> One of my testers reports no problems at all with 'last' on 2.6 _or_ 2.7
> for VR15/VR16.  Scott and (IIRC) [email-masked] are both using
> "Trusted Solaris" which my tester could not test on.
> 
> -- 
> 
> Gregory A Lundberg              Senior Partner, VRnet Company
> 1441 Elmdale Drive              [email-masked]
> Kettering, OH 45409-1615 USA    1-800-809-2195
>

---

From: Greg Bulman - EST Contractor <[email-masked]>
Date: Tue, 9 Mar 1999 09:17:18 -0800

For the record, [email-masked] is not using TSOL, Trusted Solaris.
Just plain old vanilla versions off the Server CD's (2.5.1 and 2.7).

---

From: Greg Bulman - EST Contractor <[email-masked]>
Date: Tue, 9 Mar 1999 09:56:50 -0800

Well Tommaso and Bob hit the nail on the head here.
So much for my testing scenarios.  I too confirm it isn't specific to wu-ftpd
and the vendor supplied ftpd also behaves this way.

I'll explore Sun's bug and patch reports and continue there.  Thanks for
everyone's 2nd eyes.  For me, I'm considering this thread closed as far as
as the wu-ftpd goes.  If I find that the vendor has a patch that works with
its fptd and wu-ftpd I'll post the info here and report to the Solaris
specific wu-ftpd info maintainer.

Happy computing,
-gbulman

> Tommaso wrote :-
> Right !  I just ran a similar test with the vendor ftpd running on a
> Solaris 2.5.1 system and I see the same behaviour that wu-ftpd shows.
> So either the same problem is coded into both servers, or it is somewhere else
> in the OS.
> 
> The fact that the wu-ftpd daemon does not exhibit this problem on other OS's
> makes me wonder...
> 
> Cheers, Bob
>

---

From: Chad Price <[email-masked]>
Date: Tue, 09 Mar 1999 14:59:42 -0600

Cc: 

>specific wu-ftpd info maintainer.

I've been running Sol 2.4 since it came out, and the 'last' command has
never worked correctly, for ftpd or logins either one.  wtmpx often fails
to close out sessions when the user logs out.  As a result, I only use last
to see who logged in, not who/when the logout occurred. 

When I first installed it, it was even worse, and they immediately told me
to patch the system.  This fixed it to semi-compus mentis, but not to
working order.  So I guess my conclusion is: ignore the wtmpx / last log
stuff on Solaris 2.4 (and other releases of Solaris too from what I see in
the comments), it's broken and always has been.  I do of course stand ready
to be corrected (in this case, pointed to a patch which really does fix it.)

Chad

Chad Price
Systems Manager
University of Nebraska Medical Center
600 S 42nd St
Omaha, NE 68506-6495
[email-masked]
(402) 559-9527 
(402) 559-4077 (FAX)