topic Re: Resizing the wtmp file in Operating System - HP-UX

Resizing the wtmp file

Marty Metras — Thu, 26 Jun 2003 11:57:12 GMT

Good morning,
I see my wtmp file has data over one year.( 33 Megs) Also btmp. My goal is to run a script that shows the last login of all the users to see if there are users that do not log in offen and deal with them. Since this just returns the month-daty I can not be sure if it is this year or last.
Is there a setting I can do to this file so it does not grow over x size?
Or knowing this is a binery file how do I resize it?

Marty

Re: Resizing the wtmp file

Ken Hubnik_2 — Thu, 26 Jun 2003 11:59:44 GMT

Use SAM to resize it.

SAM
Routine Task
System log files

Re: Resizing the wtmp file

Bruno Vidal — Thu, 26 Jun 2003 12:03:21 GMT

Hi,
As far i know, SAM is not able to resize it, it will trim it (resize it to 0). The best to do that
is to use /usr/sbin/acct/fwtmp.
This command can convert your wtmp/btmp files to ascii, you can then modify it/resize it to some 20 last record, and then use the same command to convert it back to binary.
Take a look man fwtmp.

Cheers.

Re: Resizing the wtmp file

Pete Randall — Thu, 26 Jun 2003 12:06:29 GMT

Marty,

We use this cron entry:
00 01 1 * * /apps/bin/ts/wtmp_shrink 1>/dev/null 2>&1

and this script:

#!/bin/ksh
################################################################################
# wtmp_shrink - Reduce the size of /etc/wtmp. Currently run from
# /etc/rc, also left as executable in /usr/bin.
#

################################################################################
if [ -s /var/adm/wtmp ]
then
echo "Shrinking /var/adm/wtmp"
/usr/lib/acct/fwtmp < /var/adm/wtmp | tail -10 | /usr/lib/acct/fwtmp -ic > /
var/adm/wtmp
else
echo "\n\tWtmp file does not exist"
echo "\tCreating /var/adm/wtmp"
> /var/adm/wtmp
fi

to keep the size of the wtmp file in check.

Pete

Re: Resizing the wtmp file

Enrico P. — Thu, 26 Jun 2003 12:06:42 GMT

Hi,
you can empty this file if not useful:

>wtmp
>btmp

Enrico.

Re: Resizing the wtmp file

Umapathy S — Thu, 26 Jun 2003 12:08:32 GMT

Marty,
Normally I nullify/empty the contents of the wtmp file in regular intervals (say once in 15 days). Write a cron job to do that. To empty the contents use this.

$cat /dev/null >wtmp

HTH,
Umapathy

Re: Resizing the wtmp file

Jean-Louis Phelix — Thu, 26 Jun 2003 12:08:54 GMT

Hi,

Bruno is right. The exact procedure is :

# cat /var/adm/wtmp | /usr/sbin/acct/fwtmp > file
...
modify the file (using a script or vi)
...
# cat file | /usr/sbin/acct/fwtmp -ic > /var/adm/wtmp

Regards.

Re: Resizing the wtmp file

Marty Metras — Thu, 26 Jun 2003 12:11:35 GMT

Pete,
I see in your script it is handling the binery stuff. Am I reading it right you are only saving 10 lines with the 'tail -10'?
I could just change that to whatwhat ever I need.
Marty

Re: Resizing the wtmp file

Marty Metras — Thu, 26 Jun 2003 12:20:15 GMT

I got it.
Thanks jean I like what you showed me because I can pull the information from the ASCII file.
Then reload the wtmp with the new data.
Thanks Pete because I can automate the process with yours.
Thanks the rest of you because you opened my eyes to other thoughts.
Marty

Re: Resizing the wtmp file

Bill Hassell — Thu, 26 Jun 2003 12:36:28 GMT

Itr's important to note that wtmp, btmp (and utmp) have no year stored in the file so entries older than 1 year will cause strange behavior with programs trying to match up login and logout events. So trimming wtmp and btmp is an important sysadmin task. fwtmp can be used to convert to ASCII and then select the records to keep, or the file can simply be copied and the original zeroed out, perhaps once a month using cron. Note that doing this while running will leave an incomplete history since a login record may be in the old file and logout for the same session in the new file.

Another solution is to use a start/stop script in /sbin/init.d to take care of logfile trimming and archiving. Since most systems will need patches a couple of times during the year, the startup sequence can be used to archive the logs without problems due to users that are already logged in.

Re: Resizing the wtmp file

Pete Randall — Thu, 26 Jun 2003 12:40:47 GMT

Marty,

Yes - 10 lines - modify as needed.

Pete

Re: Resizing the wtmp file

Marty Metras — Thu, 26 Jun 2003 12:46:36 GMT

Good point Bill,
I found in the ASCII file that that it shows the year making it easy for me to look at the data with another script. being that it is only 500,000 lines long right now I think I will just use the ASCII copy and leave the wtmp binery file as is for now. After it is only 33MB and disc space is not a problem.
Thanks again,
Marty