remove wtmp

[George Liu_2]

Since wtmp won't rotate in HPUX and it may grow huge. In which way that file can be removed and the occupied space can be released? lsof doesn't show which process use that file. Thanks.

[James R. Ferguson]

Hi:

The proper way to empty it is:

# cat /dev/null > /var/adm/wtmp

Of course, this will allow it to regrow. If you don't want to continue logging, remove the file after you have nulled it. In the absence, of a file, no logging will occur.

Regards!

...JRF...

[Massimo Bianchi]

Hi, look at this thread, there are many interesting issues


http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xc1568b82cc91d711abdc0090277a778c,00.html



Massimo

[Umapathy S]

you can nullify like

$>/var/adm/wtmp.

HTH
Umapathy

[Steve Steel]

Hi


Note that wtmp and btmp tend to grow without bound, and should be
checked regularly. Information that is no longer useful should be
removed periodically to prevent it from becoming too large. Also note
that wtmp and btmp are not created by the programs that maintain them.
Thus, if these files are removed, record-keeping is turned off.



Easiest is

sam
routine tasks
system log files

select and reduce wtmp


Steve Steel

[Marco Santerre]

I simply empty it with /dev/null using :

cat /dev/null >/var/adm/wtmp

[Helen French]

You can use SAM -> Routine tasks -> System log files to trim the log files you need including /var/adm/wtmp. You can do this once in a while to cleanup space.

If you don't want to go through SAM, just review your log files and trim to the level you need. I normally reduce the wtmp file to zero bytes, when it's safe. I do keep my old wtmp file for some time.

[S.K. Chan]

The lsof won't show because it's only written when a user logs in and it keeps the history of all logins. Empty it (like other have suggested) is the way to go as you would want to keep this file so that it continues to log.

[Steve Steel]

Hi

This explains it

10.1.3.1 Pruning the wtmp file
The wtmp file will continue to grow until you have no space left on your computer's hard disk. For this reason, many vendors include shell scripts with their UNIX releases that zero the wtmp file automatically on a regular basis (such as once a week or once a month). These scripts are run automatically by the cron program.

For example, many monthly shell scripts contain a statement that looks like this:

# zero the log file
cat /dev/null >/var/adm/wtmp
Instead of this simple-minded approach, you may wish to make a copy of the wtmp file first, so you'll be able to refer to logins in the previous month. To do so, you must locate the shell script that zeros your log file and add the following lines:

# make a copy of the log file and zero the old one
rm /var/adm/wtmp.old
ln /var/adm/wtmp /var/adm/wtmp.old
cp /dev/null /var/adm/wtmp.nul
mv /var/adm/wtmp.nul /var/adm/wtmp
Most versions of the last command allow you to specify a file to use other than wtmp by using the -f option. For example:

% last -f /var/adm/wtmp.old
Some versions of the last command do not allow you to specify a different wtmp file to search through. If you need to check this previous copy and you are using one of these systems, you will need to momentarily place the copy of the wtmp file back into its original location. For example, you might use the following shell script to do the trick:

#!/bin/sh
mv /var/adm/wtmp /var/adm/wtmp.real
mv /var/adm/wtmp.old /var/adm/wtmp
last $*
mv /var/adm/wtmp /var/adm/wtmp.old
mv /var/adm/wtmp.real /var/adm/wtmp
This approach is not without its problems, however. Any logins and logouts will be logged to the wtmp.old file while the command is running.

Steve Steel

[Dario_1]

Hi!

Every Sunday morning, after the Friday's (FULL) backup we do the following to the wtmp file:

cat /dev/null > /var/adm/wtmp

This will empty the file but will allow us to have a copy just in case we have to go back and look at it.

Regards,

DR

[George Liu_2]

Don't know why, but
cat /dev/null > /var/adm/wtmp doesn't release the space in this host, which can be seen from bdf output. Thanks.

[Helen French]

What is the size of wtmp file now?:

# ls -la /var/adm/wtmp

If the size is 0bytes and if bdf still shows the size is not reduced, then it's a bdf issue. Some process stil holding the file system space. It will be released as soon as the process is finished. Also for a better disk usage:

# du -k dir_name

[George Liu_2]

The wtmp file size is 0, and du -sk shows /var/adm updated size, but bdf doesn't.

[George Liu_2]

Shiju,
You got the point. However, lsof cannot find the processes. If it is kernel, we have to wait until next reboot. Is there any way to identify the processes? Thanks.

[Helen French]

Two commands which I can think of:

# lsof
# fuser

Also, try logging out from the system and log back in (for all users if possible). That may release the space. I wouldn't care about this since, you could see the space is free now, from 'du' output. It's just a matter of 'bdf' reporting wrongly.

[George Liu_2]

Most likely, they both report correctly. Since the file wtmp was changed to new inodes, the old inodes may still be employed by some processes and couldn't be accessed via wtmp any more. I don't know how to deal with that kind of situation. Thanks.

[Sritharan]

Hi,

command line
to trim file to zero

$ > wtmp

You can also use SAM to trim the log files.

SAM -> Routine Tasks -> System Log Files here you can trim the other system log files.


Thanks & Regards
Sri