clear the wtmp file

[Ratzie]

How would I go about clearing the wtmp file?

When I do a last|more it is quite huge, and this machine is not in production yet, so I would like to clear it out, and at least keep the first time the system was brought up.

Is there a file to change?

[Karthik S S · Accepted solution]

>wtmp

is what you need ...

-Karthik S S

[Geoff Wild]

I think you can do this:

cat /dev/null > /var/adm/wtmp

Rgds...Geoff

[Michael Schulte zur Sur]

Hi,

you also can do it with
cp /dev/null /var/adm/wtmp

greetings,

Michael

[RAC_1]

> /var/adm/wtmp
cat /dev/null > /var/adm/wtmp

But do you have any issues with that? Is who reporting wrong details etc?

Then I would advise you to check wtmp patches.

Also have a look at fwtmp command. With command you can check wtmp file and fix it.

[Helen French]

You can make these type of routine maintenance tasks through SAM. Instead of nullyfying the entire wtmp file, you can easily "trim" your log files including wtmp file. This is a good way of maintining system log files.

# sam -> Routine Tasks ->

[Jeff Ohlhausen]

The best and easiset way is to use SAM:
- administration
- log files
Trim it to the selected amount.

[H.Merijn Brand (procura]

SAM does not work on AIX :}

--8<--- Script to reduce wtmp file to sensible size
#!/opt/perl/bin/perl

use strict;
use warnings;
use User::Utmp;

my ($n, $s, $treshold, @wtmp, %type) = (0, 0, time - 7 * 24 * 60 * 60); # One week should do
User::Utmp::utmpname (shift || "wtmp");
User::Utmp::setutent ();
while (my @entry = User::Utmp::getut1 ()) {
++$n % 100 or printf STDERR " %6d %6d\r", $n, $s;
if ( $entry[0]->{ut_type} == LOGIN_PROCESS &&
$entry[0]->{ut_time} > 0 && $entry[0]->{ut_time} < $treshold) {
$s++;
next;
}
push @wtmp, @entry;
}
User::Utmp::endutent ();

print STDERR "wtmp has $n entries, I skipped $s\n";
#print STDERR "[ ", (join ", ", map { "$_ => $type{$_}" } sort { $a <=> $b } keys %type), " ]\n";

User::Utmp::utmpname ("/tmp/wtmp");
User::Utmp::putut ($_) for @wtmp;
User::Utmp::endutent ();
-->8---

i2:/var/adm 126 # clrwtmp.pl
wtmp has 359424 entries, I skipped 358595
i2:/var/adm 127 # ll wtmp /tmp/wtmp
263 -rw-r--r-- 1 root system 1920 May 28 10:24 /tmp/wtmp
2074 -rw-r--r-- 1 root system 23003136 Jan 20 08:51 wtmp
i2:/var/adm 128 # mv /tmp/wtmp wtmp

All relevant info retained this way (boot time and such)

Enjoy, Have FUN! H.Merijn