User logons not recorded in /var/adm/utmpx

I have recently upgraded my netra to Solaris 9.
User logins through x-win32 are not being registered in /var/adm/utmpx, hence they don't appear with who, last etc. Simple telnet logins are being registered in /var/adm/utmpx though.
This worked fine when the machine was running solaris 8; both telnet and x-win sessions were logged correctly.
can anyone tell me how to remedy this so that all logons are registered in utmpx on solaris 9?
thanks

The easiest way is to cat /dev/null to utmpx - this will clear out the file to 0 bytes but leave it intact.
from the /var/adm/ directory:
cat /dev/null > /var/adm/utmpx
Some docs suggest going to single user mode to do this, or stopping the utmp service daemon first, but I'm not positive this is necessary. Perhaps someone has input on that aspect. I've always just sent /dev/null to utmpx and wtmpx without a problem.
BTW - I believe "last" works with wtmpx, and "who" works with utmpx.

Similar Messages

Solaris 9 - INIT: Cannot create /var/adm/utmpx (System Hangs)

Hello,
I am unable to boot into solaris 9 after I did a init 0. I did init 0 because shutdown -y -g0 -i0 did not work.
This is the error message I get
Hardware watchdog enabled
INIT: Cannot create /var/adm/utmpx
INIT: failed write of utmpx entry:" "
INIT: failed write of utmpx entry:" "
INIT: SINGLE USER MODE
Type control-d to proceed with normal startup,
(or give root password for system maintenance):
After it asks for the password it HANGS.
I entered the password, but NOTHING HAPPENS.
I can go into sc console though.
I also rebooted using Solaris 9 cdrom in single user mode. Checked the filesystem using fsck, and no faults were found. I also tried creating a new /var/adm/utmpx file but that did not work too.
Any help would be appreciated,
Thank you,
Jacob.

Hello,
Check for /var filesystem usage,if it is not mouted as seperate filesystem then check for "/" FS usage.
There may be chances you get to have this problem if your FS is full.
If everything normal then follow the below steps, which solved similar kind of issues in the past for me.
Logon to the system and when you get prompt just run fsck on your root filesystem.
Check /etc/vfstab file to ensure that you are running fsck on correct fs name.
After completing fsck just say "reboot". The machine will boot normally.
In b/w is this machine disks are mirrored?? if so then you may need to choose the disks carefully before you run fsck.
thanks.

Var/adm/utmpx: value too large for defined datatype

Hi,
On a Solaris 10 machine I cannot use last command to view login history etc. It tells something like "/var/adm/utmpx: value too large for defined datatype".
The size of /var/adm/utmpx is about 2GB.
I tried renaming the file to utmpx.0 and create a new file using head utmpx.0 > utmpx but after that the last command does not show any output. The new utmpx file seems to be updating with new info though... as seen from file last modified time.
Is there a standard procedure to recreate a new utmpx file once it grows too largs?? I couldnt find much in man pages
Thanks in advance for any help

The easiest way is to cat /dev/null to utmpx - this will clear out the file to 0 bytes but leave it intact.
from the /var/adm/ directory:
cat /dev/null > /var/adm/utmpx
Some docs suggest going to single user mode to do this, or stopping the utmp service daemon first, but I'm not positive this is necessary. Perhaps someone has input on that aspect. I've always just sent /dev/null to utmpx and wtmpx without a problem.
BTW - I believe "last" works with wtmpx, and "who" works with utmpx.

Cannot access /var/adm/utmpx

i am working on sun v445 server with four internal disks.
i created metadevices fo internal disks and updated the vfstab accordingly.
but when i booted the system i got the message
The /var file system (/dev/md/rdsk/d120) is being checked.
fsck: could not stat /dev/md/dsk/d120: No such file or directory
WARNING - Unable to repair the /var filesystem. Run fsck
manually (fsck -F ufs /dev/md/rdsk/d120). Exit the shell when
done to continue the boot process.
on executing the fsck command it gives the same output.
and the system returns to single user maintenance mode
if i try to go to run level 3 the output is cannot access/var/adm/utmpx.
how can i proceed in this case ?
can nybody please help

sounds like dsk & rdsk column in vfstab is reversed

GPO Run these programs at user logon not taking effect when configured in Computer Configuration section

[EDIT 20140207]:
I found that the default domain policy sets "run these programs at user logon" and (other than I expected) not BOTH GPO settings become active, but the setting from the default domain policy overrides the setting from my new GPO. So I think I have
found the answer myself.
When on our W2k8-R2 DC I create a new GPO and configure
"Computer Configuration/Policies/Windows Settings/Administrative Templates/System/Logon/run these programs at user logon" to "c:\windows\system32\notepad.exe" (just for testing) it won't take effect on Win 7 SP1, no matter what the Security
Filtering options are.
It seems other settings (in the very same GPO) become active but "run these programs at user login" from the computer policies section doesn't. I configure the very same setting in the section "user policies" instead and add "Authenticated
Users" to Security Filtering, the program will be started. But that's not what I need.
I can reproduce the issue, here are the exact steps:
create a new group "group-a" for later security filtering
create a new GPO
in the new GPO set "Computer Configuration/Policies/Windows Settings/Administrative Templates/System/Logon/run these programs at user logon" to "c:\windows\system32\notepad.exe"
for setting the scope remove "authenticated users" from Security Filtering and add "group-a" instead
link the GPO to the domain root
make "test computer" a member of "group-a"
on "test computer" run "gpupdate /force", reboot, log in
Issue: notepad is not being started.
What I'm aiming for is obvious: Depending on the membership of group-a I want to configure certain programs that should be started whenever a user logs in.
gpresult /R returns that it would be applying the GPO. (It actually is but the setting "run these programs at user login" is not being applied.)
For debugging I started MMC / RSoP on one of the machines on which the GPO should have been applied and found that "run these programs at user login" is not set (which seems to be the reason why the GPO won't work on the machines).
Searching the web I found similar reports
[1] [2] but no solution was found and the user used a workaround instead.
If I change the GPO so that I use the very same setting in "user configuration" instead of "computer configuration" it works as long as I add "authenticated users" to the Security Filtering. But then the GPO is applied to all users
and not only to the ones using computers which are members of group-a. According to this howto [3] I should not remove "authenticated users" but alter the security setting instead. However, the howto seems to be aimed ad w2k3 and using Win2k8 I cannot
find security settings "apply" for "authenticated users" so I cannot remove that setting, there's only "read" or "read and modify".
So two questions:
1. Why doesn't it work when using "computer settings"
2. What about that Security Filtering with removing "authenticated users" and using group-a instead?
T.
[1] http://social.technet.microsoft.com/Forums/windows/en-US/0e280490-fba6-4ced-aba5-ae49c60e44bd/computer-gpo-run-these-programs-at-user-logon-not-working-as-intended-on-win7-clients?forum=w7itproinstall
[2] http://social.technet.microsoft.com/Forums/windows/en-US/8cb78bf8-33ec-461e-8604-32d82d016685/run-these-programs-at-user-logon?forum=winserverGP
[3] http://www.grouppolicy.biz/2010/05/how-to-apply-a-group-policy-object-to-individual-users-or-computer/

Hi,
sounds like you find the answer already.
If you have any further question, please feel free to let me know.
Have a nice day!
If you have any feedback on our support, please click
here
Alex Zhao
TechNet Community Support

Syslogd not posting to /var/adm/messages

Syslogd starts ok but will not send anything to /var/adm/messages. I did remove the existing zero value file and stopped and restarted syslog and it created a new messages file but will not populate it. All the rest of the logs appears to be populating correctly.
Contents of syslogd.conf is standard:
#ident "@(#)syslog.conf        1.5     98/12/14 SMI"   /* SunOS 5.0 */
# Copyright (c) 1991-1998 by Sun Microsystems, Inc.
# All rights reserved.
# syslog configuration file.
# This file is processed by m4 so be careful to quote (`') names
# that match m4 reserved words. Also, within ifdef's, arguments
# containing commas must be quoted.
*.err;kern.notice;auth.notice                   /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit        /var/adm/messages
*.alert;kern.err;daemon.err                     operator
*.alert;local1.none     root
*.emerg                                         *
# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice                    ifdef(`LOGHOST', /var/log/authlog, @loghost)
mail.debug                      ifdef(`LOGHOST', /var/log/syslog, @loghost)
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
ifdef(`LOGHOST', ,
user.err                                        /dev/sysmsg
user.err                                        /var/adm/messages
user.alert                                      `root, operator'
user.emerg                                      *
local1.debug            /usr/tmp/TAMAR_LOGI noticed the following on the console during bootup:
syslogd: line 12: unknown priority name "notice /dev/sysmsg"
syslogd: line 13: unknown priority name "crit /var/adm/messages"
syslogd: line 15: unknown priority name "err operator"
syslogd: line 16: unknown priority name "none root"
syslogd: line 18: unknown priority name "emerg *"
syslogd: line 24: unknown priority name "debug /var/log/syslog"
syslogd: line 31: unknown priority name "debug /usr/tmp/TAMAR_LOG"
/etc/default/syslogd has no uncommented line in the file.
At a loss on this one. Any ideas/suggestions

I found the solution to this problem. Turns out for reasons unknown to me the whitespace in the syslog.conf file got converted from tabs to spaces. As soon as I made all the white space tabs everything started working.. Go figure.

Powershell User logon script not Exiting With "Exit" scripts are set to be visible in GPO

I am trying to run this script as a user logon script and it is set to visible to the user. There are other parts of the script but It won't ever Exit. It works fine if I run it directly I only have the trouble when it is in the logon script. I'm thinking
of tryin "Kill -Id $PID" but I'm sure I'll get a bad return code.
Has anyone else experienced this or hav any ideas what I could try?
If (Test-Path U:){
Robocopy U:\ $Destination /E /move /XF "*.inf"
New-Item -Path HKCU:\Software\test\test -Name Test –Force
Else{
Exit
Else{
New-Item -Path HKCU:\Software\test\1 -Name Test1 –Force
Exit #here is where it will not stop!
Exit

Sorry, I did mention this was only a subset of the complete script.
So, what I am trying to accomplish in words.
1. Check for the existence of a certain folderon the c: Drive (that is created as apart of a different process)
2. Look to see if a registry key exisits that tells the script if it should run or not. So if certain registry key exists under HKCU then don't run if not continue.)
3. The first time a user logs in and does not find the value that the process is allready complete show the user a message box aski9ng them if they are ready to do (something) if not write a registry key saying step one has completed and then quit.
4. When the user logs in again the script looks to see if the process is complete and or if step one is complete, if step one is complete it allows the user to skip the process 2 more times but on the forth login forces the user to complete the process and
writes the final registry key that it is complete.
Like I say I have this all working correctly if I manually have the user run it. I just don't know why Exit is not being recognized when in the users login script processing of the script. I appreciate your reply and any direction you can point me to.

/var/adm/messages file not updatiing

Hi All!
Can you pls help, I´m new into solaris, so I´ve got a problem, ever since I didi "> messages" inside the /var/adm/ direcotory the messages file does not update anymore.~
I´ve done ps -ef ! grep syslogd, and the deamon is running. So pls can you help?
regards
F.R.

Make sure /var/adm/message is writable by root only (chmod 600) and restart syslogd (svcadm restart system-log)

Logon failure; the user has not been granted the requested logon type at this computer (IE App)

Hello,
Question of a newbie:
In Windows Server 2012 I'm using IE10 to simulate numerous different users. But for some of these "fake" users I got the error:
Logon failure; the user has not been granted the requested logon type at this computer.
So I opened PowerShell : GPEDIT.MSC
Computer Configuration / Windows Settings / Security Settings / Local Policies / User Rights Assignment.
In the detail zone : Double-Clic sur Allow log on locally.
Dialog box : Allow log on locally properties
But the Add User or Group
button is grayed out!
What can I do?
Thanks for your help!

Several months after...
I found the solution : the user has to be member of the Server
Operators in Active Directory.
That's all :)
Thanks

Failed to start worker process: Logon failure: the user has not been granted the requested logon type at this computer. (0x80070569

We just rebuilt our machine with server 2012, and it was working flawlessly and then randomly it started giving me this error if i would try to start up a machine. At first this was just an annoyance but now it is worrying me greatly. I have tried
everything from logging on as the domain admin account to the actual server administrator account. Nothing seems to start these machines up, and I need them to start.
'Computer1' failed to start worker process: Logon failure: the user has not been granted the requested logon type at this computer. (0x80070569).

Hi,
As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as 'Answered' as the previous steps should be helpful for many similar scenarios.
If the issue still persists and you want to return to this question, please reply this post directly so we will be notified to follow it up. You can also choose to unmark the answer as you wish.
In addition, we'd love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems.
Thanks!
Lawrence
TechNet Community Support

Var/adm/loginlog not showing any data?

hai all
i wanted to watch anyone who has tried to access the system but failed. for that i crate a file /var/adm/loginlog
then i changed its mode to 600
chgrp 600 /var/adm/loginlog
chgrp sys /var/adm/loginlon
after these command i tried to login in to system for more than 6 or 8 time, but after checking /var/adm/loginlog file i couldnt find any in formation can anybody share the reason behind this

What is the method you has used to login?
dtlogin does not and has never used the loginlog file. loginlog is
used only by /bin/login.

CCX / WFO Not Recording All Users

I've setup CCX and WFO in a lab to test compliance recording. My lab consists of the following:
- CCX 8.5.1
- WFO 8.5.2
- 3 AD users with device profiles (agent1, agent2 and agent3)
- 1 laptop with CIPC configured for network recording
When I login agent2, calls are recorded. I've verified this by logging into the WFO webpage and playing back the recordings.
When I login either agen1 or agent3, calls are not recorded. The WFO CTI logs show the error '
Not enough active connections. Not qualified.' Below are the complete CTI logs.
2013-03-26 04:55:05,123 DEBUG [(P1-10.10.10.30) EventThread|Prequalifier#isInterestingJtapiEvent:112] Agent[type=Network,dev=SEPA088B41981E0,ip=10.10.10.58,id=1.User login required] JTAPI: 16791936 [CallActiveEv] <128>
2013-03-26 04:55:05,125 DEBUG [(P1-10.10.10.30) EventThread|Prequalifier#handlePassive:144] Active event (TermConnActiveEv SEPA088B41981E0) sent for local terminal (SEPA088B41981E0). Setting connection 24229920 to active state for callid 16791936
2013-03-26 04:55:05,125 DEBUG [Outgoing#5|AgentObserver#writeEvent:841] EVT: Sending to <Agent[type=Network,dev=SEPA088B41981E0,ip=10.10.10.58,id=1.User login required]>: Head[23,366,1]ConnectionId=24229920;AssocCallId=291160144755072;EvId=23;EvName=BEGIN_CALL;CallingAddress=212;MAC=SEPA088B41981E0;Line=212;Timestamp=1364298905;CalledAddress=Unknown;CallId=16791936;<
2013-03-26 04:55:05,125 DEBUG [(P1-10.10.10.30) EventThread|Prequalifier#handlePassive:149] Talking event (CallCtlTermConnTalkingEv SEPA088B41981E0) sent for local terminal (SEPA088B41981E0). Setting connection 24229920 to active state for callid 16791936
2013-03-26 04:55:05,126 DEBUG [(P1-10.10.10.30) EventThread|Prequalifier#isInterestingJtapiEvent:112] Agent[type=Network,dev=SEPA088B41981E0,ip=10.10.10.58,id=1.User login required] JTAPI: 16791936 [CallCtlTermConnTalkingEv SEPA088B41981E0] <128>
2013-03-26 04:55:05,126 DEBUG [(P1-10.10.10.30) EventThread|CallTalkingQualifier#isQualified:83] Not enough active connections. Not qualified.
2013-03-26 04:55:10,128 DEBUG [(P1-10.10.10.30) EventThread|Prequalifier#isInterestingJtapiEvent:112] Agent[type=Network,dev=SEPA088B41981E0,ip=10.10.10.58,id=1.User login required] JTAPI: 16791936 [CallCtlConnEstablishedEv] <129>
2013-03-26 04:55:10,128 DEBUG [(P1-10.10.10.30) EventThread|CallEstablishedQualifier#isQualified:83] Not enough active connections. Not qualified.
2013-03-26 04:55:11,613 DEBUG [(P1-10.10.10.30) EventThread|AgentObserverImpl#terminalChangedEvent:268] Agent[type=Network,dev=SEPA088B41981E0,ip=10.10.10.58,id=1.User login required] JTAPI: [CiscoRTPOutputStartedEv] <136>
2013-03-26 04:55:11,614 DEBUG [Outgoing#5|AgentObserver#sendFakeEstablishedEvent:534] Sending fake established event for call id: 16791936
2013-03-26 04:55:11,614 DEBUG [Outgoing#5|AgentObserver#sendFakeDirectionalEvent:513] Sending fake directional event for call id: 16791936
2013-03-26 04:55:11,614 DEBUG [Outgoing#5|AgentObserver#writeEvent:841] EVT: Sending to <Agent[type=Network,dev=SEPA088B41981E0,ip=10.10.10.58,id=1.User login required]>: Head[15,376,1]ConnectionId=24229920;AssocCallId=291160144755072;EvId=15;EvName=CALL_ORIGINATED;CallingAddress=212;MAC=SEPA088B41981E0;Line=212;Timestamp=1364298911;CalledAddress=Unknown;CallId=16791936;<
2013-03-26 04:55:11,615 DEBUG [Outgoing#5|AgentObserver#writeEvent:841] EVT: Sending to <Agent[type=Network,dev=SEPA088B41981E0,ip=10.10.10.58,id=1.User login required]>: Head[10,378,1]ConnectionId=24229920;AssocCallId=291160144755072;EvId=10;EvName=CALL_ESTABLISHED;CallingAddress=212;MAC=SEPA088B41981E0;Line=212;CallId=16791936;CalledAddress=Unknown;Timestamp=1364298911;<
2013-03-26 04:55:11,615 DEBUG [Outgoing#5|AgentObserver#writeEvent:841] EVT: Sending to <Agent[type=Network,dev=SEPA088B41981E0,ip=10.10.10.58,id=1.User login required]>: Head[31,476,1]ConnectionId=24229920;EvId=31;EvName=RTP_OUTPUT_START;PacketSize=20;Timestamp=1364298911;AssocCallId=291160144755072;PayloadType=G711ULAW64K;MAC=SEPA088B41981E0;Line=212;CallId=16791936;RemotePort=25044;Silence=false;RemoteIP=10.10.10.30;<
2013-03-26 04:55:11,653 DEBUG [(P1-10.10.10.30) EventThread|AgentObserverImpl#terminalChangedEvent:268] Agent[type=Network,dev=SEPA088B41981E0,ip=10.10.10.58,id=1.User login required] JTAPI: [CiscoRTPInputStartedEv] <136>
2013-03-26 04:55:11,654 DEBUG [Outgoing#5|AgentObserver#writeEvent:841] EVT: Sending to <Agent[type=Network,dev=SEPA088B41981E0,ip=10.10.10.58,id=1.User login required]>: Head[30,444,1]ConnectionId=24229920;AssocCallId=291160144755072;EvId=30;EvName=RTP_INPUT_START;LocalIP=10.10.10.126;LocalPort=24598;PacketSize=20;MAC=SEPA088B41981E0;PayloadType=G711ULAW64K;Line=212;Timestamp=1364298911;CallId=16791936;<
2013-03-26 04:55:17,433 DEBUG [(P1-10.10.10.30) EventThread|Prequalifier#isInterestingJtapiEvent:112] Agent[type=Network,dev=SEPA088B41981E0,ip=10.10.10.58,id=1.User login required] JTAPI: 16791936 [CallCtlConnEstablishedEv] <129>
2013-03-26 04:55:17,433 DEBUG [Outgoing#5|AgentObserver#writeEvent:841] EVT: Sending to <Agent[type=Network,dev=SEPA088B41981E0,ip=10.10.10.58,id=1.User login required]>: Head[10,384,1]ConnectionId=24229920;AssocCallId=291160144755072;EvId=10;EvName=CALL_ESTABLISHED;CallingAddress=212;MAC=SEPA088B41981E0;Line=212;Timestamp=1364298917;CalledAddress=7173646217;CallId=16791936;<
Any thoughts?
- Robb

Resolved... Apparently you need to add the physical phones and the device profiles as recording devices. The documentation is somewhat lacking in this regard. Anyway, hopefully this helps someone else.

Last three user logon date and time

Hi Everybody,
I would like to find out last few user logon details of an user. Where can I get this information if ST01 trace is not turn on? Table USR02 only shows the last logon that is insufficient.
Thanks!

You can use the dynamic audit logs in SM19 to record a successfull logon event for a single or all users.
If you want the information readily available, you can activate parameter rsau/enable and set static filters.
If it is too late for this, then you would need to look in the application statistics (ST03N in Expert Mode) to get the information.

Normal users can not login CDE

Hi every body.
I have just installed Solaris 10 in a Ultra 10 box. When my normal users tray to login CDE they must wait long and at the end they have a message window like this:
_DtMessage Failure Messaging System Inoperative To restart: 1) Save all open data files. 2) Logout. 3) Login again. Note: The current session will not be saved. When you are ready to begin the restart process click [ok] and proceed to save your files. behind this window there are another one: Action Required DT messaging system could not be started. To correct the problem 1- Chose [ok] to return to the login screen 2- select failsafe session from the login screen's option menu and login. 3- Check to see that the host name is correct in these locations /etc/src.sh /etc/hosts /usr/adm/inet.sec For additional information see the DT users guide. This issue only occurs when the home directory is mounted via nfs. If is mounted locally there are no problems. I deleted .dt* directories but this does not solve the problem. Any idea will be very appreciated. Guix

Is the "ttdbserverd" rpc service running on the nfs server?
Does the nfs client log anything to it's /var/adm/messages file?
For example errors like this:
Aug 12 18:43:31 elise-3com.tools.intra /usr/dt/bin/ttsession[851]: [ID 424917 daemon.error] Error: rpc.ttdbserverd on leo is not running
Aug 12 18:43:31 elise-3com.tools.intra /usr/dt/bin/ttsession[851]: [ID 908584 daemon.error] Ttdb_client::connectToDb(): fcntl(F_SETFD): Bad file number

Where is log of user logon and log ff in WCS or WLC?

My configuration is 4404 WLCs with WCS. We have a guest WLAN configured and the users authenticate using Web Auth and local accounts created by a Lobby Ambassador. My question is if there is a log somewhere that records when users logon and logoff when they are authenticating to local accounts.
Thanks,
Deanna

I am also looking for the same information in my syslogs. I have increased the logging level to info and user ID is still not there. Does anyone know how to get user ID information out of the syslog?
Thanks

User logons not recorded in /var/adm/utmpx

Similar Messages

Maybe you are looking for