topic Re: remove wtmp in Operating System - HP-UX

remove wtmp

George Liu_2 — Tue, 03 Jun 2003 13:07:33 GMT

Since wtmp won't rotate in HPUX and it may grow huge. In which way that file can be removed and the occupied space can be released? lsof doesn't show which process use that file. Thanks.

Re: remove wtmp

James R. Ferguson — Tue, 03 Jun 2003 13:09:49 GMT

Hi:

The proper way to empty it is:

# cat /dev/null > /var/adm/wtmp

Of course, this will allow it to regrow. If you don't want to continue logging, remove the file after you have nulled it. In the absence, of a file, no logging will occur.

Regards!

...JRF...

Re: remove wtmp

Massimo Bianchi — Tue, 03 Jun 2003 13:10:05 GMT

Hi, look at this thread, there are many interesting issues

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xc1568b82cc91d711abdc0090277a778c,00.html

Massimo

Re: remove wtmp

Umapathy S — Tue, 03 Jun 2003 13:11:08 GMT

you can nullify like

$>/var/adm/wtmp.

HTH
Umapathy

Re: remove wtmp

Steve Steel — Tue, 03 Jun 2003 13:13:39 GMT

Hi

Note that wtmp and btmp tend to grow without bound, and should be
checked regularly. Information that is no longer useful should be
removed periodically to prevent it from becoming too large. Also note
that wtmp and btmp are not created by the programs that maintain them.
Thus, if these files are removed, record-keeping is turned off.

Easiest is

sam
routine tasks
system log files

select and reduce wtmp

Steve Steel

Re: remove wtmp

Marco Santerre — Tue, 03 Jun 2003 13:14:33 GMT

I simply empty it with /dev/null using :

cat /dev/null >/var/adm/wtmp

Re: remove wtmp

Helen French — Tue, 03 Jun 2003 13:15:29 GMT

You can use SAM -> Routine tasks -> System log files to trim the log files you need including /var/adm/wtmp. You can do this once in a while to cleanup space.

If you don't want to go through SAM, just review your log files and trim to the level you need. I normally reduce the wtmp file to zero bytes, when it's safe. I do keep my old wtmp file for some time.

Re: remove wtmp

S.K. Chan — Tue, 03 Jun 2003 13:15:45 GMT

The lsof won't show because it's only written when a user logs in and it keeps the history of all logins. Empty it (like other have suggested) is the way to go as you would want to keep this file so that it continues to log.

Re: remove wtmp

Steve Steel — Tue, 03 Jun 2003 13:16:32 GMT

Hi

This explains it

10.1.3.1 Pruning the wtmp file
The wtmp file will continue to grow until you have no space left on your computer's hard disk. For this reason, many vendors include shell scripts with their UNIX releases that zero the wtmp file automatically on a regular basis (such as once a week or once a month). These scripts are run automatically by the cron program.

For example, many monthly shell scripts contain a statement that looks like this:

# zero the log file
cat /dev/null >/var/adm/wtmp
Instead of this simple-minded approach, you may wish to make a copy of the wtmp file first, so you'll be able to refer to logins in the previous month. To do so, you must locate the shell script that zeros your log file and add the following lines:

# make a copy of the log file and zero the old one
rm /var/adm/wtmp.old
ln /var/adm/wtmp /var/adm/wtmp.old
cp /dev/null /var/adm/wtmp.nul
mv /var/adm/wtmp.nul /var/adm/wtmp
Most versions of the last command allow you to specify a file to use other than wtmp by using the -f option. For example:

% last -f /var/adm/wtmp.old
Some versions of the last command do not allow you to specify a different wtmp file to search through. If you need to check this previous copy and you are using one of these systems, you will need to momentarily place the copy of the wtmp file back into its original location. For example, you might use the following shell script to do the trick:

#!/bin/sh
mv /var/adm/wtmp /var/adm/wtmp.real
mv /var/adm/wtmp.old /var/adm/wtmp
last $*
mv /var/adm/wtmp /var/adm/wtmp.old
mv /var/adm/wtmp.real /var/adm/wtmp
This approach is not without its problems, however. Any logins and logouts will be logged to the wtmp.old file while the command is running.

Steve Steel

Re: remove wtmp

Dario_1 — Tue, 03 Jun 2003 13:23:39 GMT

Hi!

Every Sunday morning, after the Friday's (FULL) backup we do the following to the wtmp file:

cat /dev/null > /var/adm/wtmp

This will empty the file but will allow us to have a copy just in case we have to go back and look at it.

Regards,

DR

Re: remove wtmp

George Liu_2 — Tue, 03 Jun 2003 13:27:40 GMT

Don't know why, but
cat /dev/null > /var/adm/wtmp doesn't release the space in this host, which can be seen from bdf output. Thanks.

Re: remove wtmp

Helen French — Tue, 03 Jun 2003 13:32:57 GMT

What is the size of wtmp file now?:

# ls -la /var/adm/wtmp

If the size is 0bytes and if bdf still shows the size is not reduced, then it's a bdf issue. Some process stil holding the file system space. It will be released as soon as the process is finished. Also for a better disk usage:

# du -k dir_name

Re: remove wtmp

George Liu_2 — Tue, 03 Jun 2003 13:36:29 GMT

The wtmp file size is 0, and du -sk shows /var/adm updated size, but bdf doesn't.

Re: remove wtmp

George Liu_2 — Tue, 03 Jun 2003 13:42:02 GMT

Shiju,
You got the point. However, lsof cannot find the processes. If it is kernel, we have to wait until next reboot. Is there any way to identify the processes? Thanks.

Re: remove wtmp

Helen French — Tue, 03 Jun 2003 14:05:27 GMT

Two commands which I can think of:

# lsof
# fuser

Also, try logging out from the system and log back in (for all users if possible). That may release the space. I wouldn't care about this since, you could see the space is free now, from 'du' output. It's just a matter of 'bdf' reporting wrongly.

Re: remove wtmp

George Liu_2 — Tue, 03 Jun 2003 14:16:09 GMT

Most likely, they both report correctly. Since the file wtmp was changed to new inodes, the old inodes may still be employed by some processes and couldn't be accessed via wtmp any more. I don't know how to deal with that kind of situation. Thanks.

Re: remove wtmp

Sritharan — Wed, 04 Jun 2003 05:25:22 GMT

Hi,

command line
to trim file to zero

$ > wtmp

You can also use SAM to trim the log files.

SAM -> Routine Tasks -> System Log Files here you can trim the other system log files.

Thanks & Regards
Sri