mysql leds the /var full

[Achilles_2]

When I started mysql server everytime, both "/var/adm/wtmps" & "/var/adm/wtmps" & "/var/adm/btmps" files" files become increasing. How can I avoid it, cos it will make the /var parition full.

Thanks

[Bill Hassell]

/var/adm is where almost every logfile is stored and these logfiles will grow in size every day. That's why you must monitor the logfiles by first reading them to determine if you have a problem (and then fix the problem), then truncate the logfiles once you have read the messages. /var will fill up on every Unix system unless you take action -- not just logfiles but email and printer files and so on. This is part of your daily duties as a sysadmin. Most sysadmins write scripts to monitor logfiles and mountpoint sizes.

[Michael Steele_2]

1) /var/adm/wtmp is the repository for the 'last' command. So this is likely related to user login problems. Has anybody been complaining?

/var/adm/wtmp is not a file that can be easily reduced without corruption. Have you done anything like ' vi /var/adm/wtmp'? If your output from 'last' command looks messed up then /var/adm/wtmp is corrupt. So 'null' this file with '>/var/adm/btmp' and go through SAM to trim this file in the future. Refer to basic administrator commands in SAM.


2) /var/adm/btmp records bad logins and is used with the 'lastb' command. Same rules from 1) apply here.

3) Run this commands, get the errors, paste them in a response.

[Dennis Handly]

>Michael: 1) /var/adm/wtmp is the repository for the 'last' command. So this is likely related to user login problems.

The problems are logged in btmps that you mentioned in 2).

>/var/adm/wtmp is not a file that can be easily reduced without corruption.

You can use fwtmp(1M) to convert the files to an ascii format that you can edit.

>3) Run this commands, get the errors, paste them in a response.

Were you suggesting running last(1) and lastb(1)?
Note the latter may have passwords, so only a highly edited form should be added to this thread. See:
http://docs.hp.com/en/B2355-60130/last.1.html

[Michael Steele_2]

Dennis, . . .

Re: passwords. I have no idea what you are talking about. Logging into other accounts? You don't need a password from root to log into another account. That's what 'su' is for.

Getting into little side shows like this can be very distracting to the author. If you focus on answering the author's questions then you avoid this problem.

[Dennis Handly]

>Michael: Re: passwords. I have no idea what you are talking about. Logging into other accounts?

Read the lastb(1) warning about possible passwords.

>If you focus on answering the author's questions

I was warning about posting the contents of btmps vs your suggestion of errors.

[Michael Steele_2]

Dennis:

I've never seen any lastb report display a password. And is so then the author can easily filter out this information. So what's up?

Got a link to a real life example?

(* Practically speaking I think this is a dead end and the side show stopped. *)

[Bill Hassell]

Actually, btmp is a security risk. It has to do with busy users that don't pay attention to the actual prompt and start typing on automatic. I'm sure every one of us has at one time typed the username where the prompt said Password? and typed your password where the prompt said: login:

The problem is that the password you accidentally typed at the login prompt was recorded in btmp. A hacker then compares last and lastb and looks for a correct login right after a bad login with a user name that suspiciously looks like a password. Thus, /var/adm/btmp must be kept at 600 permission, owned by root. This keeps the lastb command from reporting possible passwords.

[Dennis Handly]

>Bill: Actually, btmp is a security risk. ... I'm sure every one of us has at one time ... typed your password where the prompt said: login:

Exactly. That was why I reporting the warning in the man page.

[James R. Ferguson]

Hi:

>Bill: I'm sure every one of us has at one time typed the username where the prompt said Password? and typed your password where the prompt said: login:

>Bill: The problem is that the password you accidentally typed at the login prompt was recorded in btmp.

Very true. I've done it too. Dennis was on-the-mark pointing out that '/var/adm/btmps' should be carefully managed and not made generally available for inspection, exactly as the manpages note, too.

>Michael: You don't need a password from root to log into another account. That's what 'su' is for.

True, of course, but both the success or failure of any transition is recorded in '/var/adm/sulog' --- yet another log in '/var'.

Regards!

...JRF...