Managing /var/adm/wtmp

[Patrick Bridwell]

What's the best way to delete records from /var/adm/wtmp? I know I can delete the whole file but I want to keep about a month of data and purge the rest.

[Alex Glennie]

cat /dev/null > /var/adm/wtmp

[Alex Glennie]

Note that zeroing /var/adm/wtmp on a running
system may cause errors to be reported from the who command. These errors
are caused by who not finding the users currently logged in. The best way to
trim /var/adm/wtmp is to do it in single user mode. Do not zero the
/etc/utmp...this is done automatically

[melvyn burnard]

I think the fwtmp command may be the one to use here
do man fwtmp

[Rick Garland]

Using SAM; Routine Tasks - can trim the file to the recommended size.

[Patrick Bridwell]

SAM, to my knowledge, does not allow trimming of binary files.

Assigning /dev/null to the file would wipe out the whole file...I want to keep a months worth of data.

I read the man page on fwtmp but it is not clear on what I should do.

[Tom Danzig · Accepted solution]

You could do:

cat /var/adm/wtmp | /usr/sbin/acct/fwtmp > /tmp/ascii_wtmp

vi /tmp/ascii_wtp to delete the records you want.

cat /tmp/ascii_wtmp | /usr/sbin/acct/fwtmp -ic > /var/adm/wtmp

I've done this and it works quite well.

[James R. Ferguson]

Pat:

You might try using fwtmp to convert the current wtmp file to an ASCII file that you can further manuipulate with a script of your own which trims the contents down.

...JRF...

[Antoanetta Naghiu]

If you want to see wtmp contains, run last (see man last). To clean up wtmp, I'm using #>0 (or if you are not lazy to type, same thing as Alex said: #cat /dev/null >/var/adm/wtmp.

[Patrick Bridwell]

Thanks,

Tom Danzig's answer hit the nail on the head.

I appreciate all of your replies.

[CHRIS_ANORUO]

Patrick,

It will be a great work to put the line commands in cron file. Example:
0 22 1 6,12 * /var/adm/wtmp | /usr/sbin/acct/fwtmp > /tmp/ascii_wtmp
5 22 1 6,12 * /tmp/ascii_wtmp | /usr/sbin/acct/fwtmp > /var/adm/wtmp

Chris