topic Re: stop wtmp logging in Operating System - HP-UX

stop wtmp logging

Dave Bunting — Wed, 12 Dec 2001 05:18:56 GMT

Hi,

How do I stop wtmp from logging?

i zeroed /var/adm/wtmp [cat /dev/null] but it keeps on growing... how do i stop this?

Thanks

Dave

Re: stop wtmp logging

Animesh Chakraborty — Wed, 12 Dec 2001 05:30:55 GMT

Hi,
The file /var/adm/btmp contains bad login entries for each invalid logon
attempt and the file /var/adm/wtmp contains a record of all logins and
logouts. See the man page utmp(4) for more information.

They are binary data files, so they cannot be read directly. The can however
be read with the following commands:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp
# /usr/sbin/acct/fwtmp < /var/adm/btmp

The "last" and "lastb" commands display the information is a readable format.

The files can be zeroed or removed but if they are removed they need to be
manually recreated as they not created by the programs that maintain them.
Thus, if these files are removed, record-keeping is turned off.

If you want to recreate them note the ownerships and permissions before
removing them and reset the ownerships and permissions after recreating the
files (usually with touch to create an empty files). This is EXTREMELY
important -> especially for the btmp file.
HP ONLY

Re: stop wtmp logging

Michael Tully — Wed, 12 Dec 2001 05:39:07 GMT

Hi,

One of the easiest ways is to do this through
sam.

sam --> routine tasks -->
system log files --> choose /var/adm/wtmp
choose actions --> trim -->
trim to zero
exit SAM and then remove the file.
This should fix it.

-Michael

Re: stop wtmp logging

T. M. Louah — Wed, 12 Dec 2001 07:47:51 GMT

Just adding to above, /var/adm/wtmp and /var/adm/btmp files tend to grow without bound (until they fill up the filesystem). These data files contain encoded information, so it is generally not useful to read them directly. The last(1) and lastb(1) commands display this log information in a plain text format.

Re: stop wtmp logging

Printaporn_1 — Wed, 12 Dec 2001 09:40:07 GMT

why you want to stop wtmp from logging , it useful but in 10.20 it can be so big , just manage it size using as someone state above.