What is the difference between btmp & btmps and wtmp, wtmps & wtmpx ?

[X0NET0]

Hi All,

What is the difference between btmp & btmps and wtmp, wtmps & wtmpx ? Which one is actually being used ?

# ll *tmp*
-rw------- 1 root other 0 Jun 30 2008 btmp
-rw------- 1 root other 264060 May 12 16:16 btmps
-rw-rw-r-- 1 adm adm 97860 May 13 14:50 wtmp
-rw-rw-r-- 1 adm adm 5249252 May 13 17:07 wtmps
-rw-r--r-- 1 root sys 280 May 13 14:50 wtmpx

Thank you.

Regards,
Saw

[Ganesan R · Accepted solution]

Hi,

I just gone through 11iv2 references and it seems utmp/wtmp/btmp are obseleted and replaced with utmps/wtmps/btmps

see this links

http://docs.hp.com/en/B2355-60103/utmp.4.html

New files:
http://docs.hp.com/en/B2355-60103/wtmps.4.html
http://docs.hp.com/en/B2355-60103/utmps.4.html

[Sajjad Sahir]

Dear friend

These files, which hold user and accounting information for such commands as last, who, write, and login

File btmps contains bad login entries for each invalid logon attempt. File wtmps contains a record for all logins and logouts apart from accounting records


wtmpfix
wtmpfix examines the standard input or named files in wtmps format, corrects the time/date stamps to make the entries consistent, and writes to the standard output. A - can be used in place of files to indicate the standard input. If time/date corrections are not performed, acctcon1 will fault when it encounters certain date-change records.

Each time the date is set, a pair of date change records is written to WTMPS_FILE. The first record is the old date denoted by the string old time placed in the line field and the flag OLD_TIME placed in the type field of the utmps structure. The second record specifies the new date, and is denoted by the string new time placed in the line field and the flag NEW_TIME placed in the type field. wtmpfix uses these records to synchronize all time stamps in the file. wtmpfix nullifies date change records when writing to the standard output by setting the time field of the utmps structure in the old date change record equal to the time field in the new date change record. This prevents wtmpfix and acctcon1 from factoring in a date change record pair more than once.

In addition to correcting time/date stamps, wtmpfix checks the validity of the name field to ensure that it consists solely of alphanumeric characters or spaces. If it encounters a name that is considered invalid, it changes the login name to INVALID and writes a diagnostic to the standard error. This minimizes the risk that acctcon1 will fail when processing connect accounting records.

thanks and regards

Sajjad Sahir

[James R. Ferguson]

Hi:

The 'wtmps' files if present log (in binary format) good, last login activity.

The 'btmps' files if present log (in binary format) bad or unsuccessful login activity.

If you wish to stop recording either activity, simply remove the appropriate file. If there is activity that you want to record but it is not, then you need to create the file.

Be advised that the permissions of 'btmps' should be readable _only_ by root. Bungled attempts by users to login may leave clear-text password information in 'btmps'.

The 'last' command is used to read 'wtmps' whereas the 'lastb' command reads 'btmps'. See the 'last(1)' manpages for more information.

Regards!

...JRF...

[X0NET0]

Hi Guys,

I just wanted to confirm which tmp files that I should use to cleanup with the daily log cleaning script that I have.

Based on you guys feedback and the date and time changes on my system for these files, I am going to edit the script to clean up wtmps and btmps only.

Thanks.

Regards,
SSL

[Bill Hassell]

Unlike syslog and mail.log which are plain ASCII, the wtmp and btmp files are binary and cannot be trimmed without corrupting the records. And as mentioned, record pairs (login/logout) must be maintained or commands like who will show 'ghost' login sessions. Unless you can guarentee a time when no one is logged in, even a simple cp and zero the file may create orphaned records.

The best solution is to rotate the wtmp/btmp files at reboot. The logs will be intact and can be rotated before any networking or users can login. To rotate, copy the file (typically to something like wtmp.1 or wtmp.20090514), then zero (don't remove) the file with something like: cat /dev/null > wtmp. wtmp and btmp won't grow significantly unless you have thousands of users or cronjobs, or you have hackers trying to break in with failed login attempts (in which case you'll have to address that issue).

[X0NET0]

Hi Guys,

Attached is a script that I got from HP Forum yesterday. Can I use it after I change the /var/adm/btmp and wtmp to btmps and wtmps respectively ? I am not familiar with the script.

Regards,
SSL

[Suraj K Sankari]

Hi,
You can used this script for triming the log files.
The below things I used to do for trimming my log files.

>/var/adm/btmp
>/var/adm/wtmp
>/var/adm/wtmps

just give greater then sign and the filename it will make your file into 0 (Zero) bites.

I used this method to tirmming the log files.

Suraj

[Dennis Handly]

>Can I use it after I change the /var/adm/btmp and wtmp to btmps and wtmps respectively?

Yes.
You may also want to replace compress and .Z by gzip and .gz.

[X0NET0]

Hi Guys,

I have tested the script and it works perfectly. Thank you all very much guys.

Regards,
SSL