Resizing the wtmp file

[Marty Metras]

Good morning,
I see my wtmp file has data over one year.( 33 Megs) Also btmp. My goal is to run a script that shows the last login of all the users to see if there are users that do not log in offen and deal with them. Since this just returns the month-daty I can not be sure if it is this year or last.
Is there a setting I can do to this file so it does not grow over x size?
Or knowing this is a binery file how do I resize it?

Marty

[Ken Hubnik_2]

Use SAM to resize it.

SAM
Routine Task
System log files

[Bruno Vidal]

Hi,
As far i know, SAM is not able to resize it, it will trim it (resize it to 0). The best to do that
is to use /usr/sbin/acct/fwtmp.
This command can convert your wtmp/btmp files to ascii, you can then modify it/resize it to some 20 last record, and then use the same command to convert it back to binary.
Take a look man fwtmp.

Cheers.

[Pete Randall · Accepted solution]

Marty,

We use this cron entry:
00 01 1 * * /apps/bin/ts/wtmp_shrink 1>/dev/null 2>&1


and this script:

#!/bin/ksh
################################################################################
# wtmp_shrink - Reduce the size of /etc/wtmp. Currently run from
# /etc/rc, also left as executable in /usr/bin.
#

################################################################################
if [ -s /var/adm/wtmp ]
then
echo "Shrinking /var/adm/wtmp"
/usr/lib/acct/fwtmp < /var/adm/wtmp | tail -10 | /usr/lib/acct/fwtmp -ic > /
var/adm/wtmp
else
echo "\n\tWtmp file does not exist"
echo "\tCreating /var/adm/wtmp"
> /var/adm/wtmp
fi


to keep the size of the wtmp file in check.


Pete

[Enrico P.]

Hi,
you can empty this file if not useful:

>wtmp
>btmp

Enrico.

[Umapathy S]

Marty,
Normally I nullify/empty the contents of the wtmp file in regular intervals (say once in 15 days). Write a cron job to do that. To empty the contents use this.

$cat /dev/null >wtmp

HTH,
Umapathy

[Jean-Louis Phelix]

Hi,

Bruno is right. The exact procedure is :

# cat /var/adm/wtmp | /usr/sbin/acct/fwtmp > file
...
modify the file (using a script or vi)
...
# cat file | /usr/sbin/acct/fwtmp -ic > /var/adm/wtmp

Regards.

[Marty Metras]

Pete,
I see in your script it is handling the binery stuff. Am I reading it right you are only saving 10 lines with the 'tail -10'?
I could just change that to whatwhat ever I need.
Marty

[Marty Metras]

I got it.
Thanks jean I like what you showed me because I can pull the information from the ASCII file.
Then reload the wtmp with the new data.
Thanks Pete because I can automate the process with yours.
Thanks the rest of you because you opened my eyes to other thoughts.
Marty

[Bill Hassell]

Itr's important to note that wtmp, btmp (and utmp) have no year stored in the file so entries older than 1 year will cause strange behavior with programs trying to match up login and logout events. So trimming wtmp and btmp is an important sysadmin task. fwtmp can be used to convert to ASCII and then select the records to keep, or the file can simply be copied and the original zeroed out, perhaps once a month using cron. Note that doing this while running will leave an incomplete history since a login record may be in the old file and logout for the same session in the new file.

Another solution is to use a start/stop script in /sbin/init.d to take care of logfile trimming and archiving. Since most systems will need patches a couple of times during the year, the startup sequence can be used to archive the logs without problems due to users that are already logged in.

[Pete Randall]

Marty,

Yes - 10 lines - modify as needed.


Pete

[Marty Metras]

Good point Bill,
I found in the ASCII file that that it shows the year making it easy for me to look at the data with another script. being that it is only 500,000 lines long right now I think I will just use the ASCII copy and leave the wtmp binery file as is for now. After it is only 33MB and disc space is not a problem.
Thanks again,
Marty