How do I prune wtmp and btmp?

[Kathi Garrison]

The man page suggests that these files can get quite large and should be checked regularly and information no longer useful should be removed. Although I check them regularly, I don't know how to remove information. Entries on my system go back over a year now.

Ideally, I would like to remove information that is older than a month or so. If it is a simple command line I could use cron.

[Marc Ahrendt]

i just use the following
cat /dev/null > /var/adm/wtmp
cat /dev/null > /var/adm/btmp
i do this after copying wtmp and btmp elsewhere for backup/history purposes

[James R. Ferguson · Accepted solution]

Hi Kathi:

To null the file entirely and start fresh:

# cat /dev/null > /var/adm/wtmp

To trim it to your liking, retaining some data do:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

At this point, you may edit the /tmp/wtmp file, since it is a ASCII file and then convert it back to binary.

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

You can do the same for the 'btmp' data.

Regards!

...JRF...

[Sridhar Bhaskarla]

I am not sure if you can trim these log files to a selected size. You can copy them to a different directory and then zero them.

#cp /var/adm/btmp /your_backup_dir/
#compress /your_backup_dir/btmp
If you want you can use log rotation method.
The same case for wtmp

#cat /dev/null > /var/adm/btmp
#cat /dev/null > /var/adm/wtmp

-Sri

[Sridhar Bhaskarla]

There goes the champion!!!

-Sri

[Sanjay_6]

Hi,

I also do the same as mark does.

cat /dev/null > /var/adm/wtmp
cat /dev/null > /var/adm/btmp

Thanks

[Kathi Garrison]

Thanks. I suspected I could just use cat /dev/null, but hoped there might be a more graceful way to do it. It looks like the least trouble would be to zero them now, and maintain them more often with cron.

-Kathi

[someone_4]

Hello
Here is a script that I use that clears allot of the main logs. wtmp btmp cron log syslog.log
mail.log I set up in cron like this with crontab -e

58 23 * * * /usr/local/bin/dailylogs.sh TRACE# Daily log clear script


Richard

[Bill Hassell]

It's important to note that the wtmp and btmp files can only handle 1 year's worth of data (or more accurately, there is no year stored in the file). Thus, is wtmp is more than a year old, there will be old entries that don't apply as they may be one or more years old.

It's best to scan wtmp and btmp with last abd lastb (respectively) and save off any useful information. Then zero these binary files, probably every 6 months is useful.