sizes of wtmp & btmp too large

[Ron Bromwell]

Hi,
I recently noticed a low amount of space in /var. I the process of trying to clean up some old files, I came across wtmp and btmp. Both of these files are pretty large (wtmp is over 90 Meg.) Since I can't vi the files to trim them down, what would be the best method. If I removed them and than touch them, would there be any repercussions. Also, is there an easy way to automatically trim them in the future?

Thanks,
Ron

[James R. Ferguson]

Hi Ron:

To trim them to an empty file do this:

# cat /dev/null > /var/adm/wtmp
# cat /dev/null > /var/adm/btmp

If you never want them built, remove them entirely. This shuts off the logging functions when (at least) an empty file doesn't exist.

If you want to analyze and manage these files in a more rigorous manner, take a look at 'acctcon' (man 1M) and 'fwtmp' (man 1M).

Regards!

...JRF...

[John Poff]

The easiest way to handle them is to null them out like this:

>wtmp
>btmp

This will set the file size back to zero while the file is still open. If you have problems with these files getting large, you could probably put something like this into cron.

[thewho?]

Hello Ron,
You can truncate them with these commands:

>/var/adm/wtmp
>/var/adm/btmp

But before you do that, please understand that these files contain the history of logins to your server. In other words, these files are used by commands like 'last' and 'finger' to tell you who, when and from where has been in your server. We usually keep 3 months worth of history at all times.
You can copy these files to a filesystem with more space and still be able to access its information, for ex:
last -f /otherfs/wtmp

HTH,
Luis

[Lisa Moore]

Ron,
I trim my system logs every week manually to keep a constant check on things. Here's how I do it:

Trim system logs:
Logon as root
Sam (return)
routine tasks (return)
system logfiles (ret)
Highlight /var/adm/btmp
/var/adm/wtmp
Tab->Actions->Trim->Trim to zero
Exit

Lisa

[Ron Bromwell]

Thanks for the help with this. I'll have to try and script something to clean these up after they hit a certain size. Just wanted to make sure I would not cause any major system problems by empting them

[Michael Roberts_3]

Here is the script I use to trim them wtmp down. It is interactive so I can select the data before which I don't care about the info.

#!/usr/bin/ksh
set -x
print " get wtmp in ascii format"
/usr/sbin/acct/fwtmp /var/tmp/wtmp.out

print "edit wtmp "
sleep 3
vi /var/tmp/wtmp.out

print "put it back in binary format"
/usr/sbin/acct/fwtmp -ic < /var/tmp/wtmp.out >wtmp

print " remove ascii file then verify wtmp"
sleep 3
rm /var/tmp/wtmp.out

read ans?"Verify ? y/[n] "

[[ $ans = [yY] ]] &&
/usr/sbin/acct/fwtmp

[Shannon Petry]

Before you start just blanking these files, you should first understand what they are for.

Someone said" they trim these logs weekly to keep a constant check on things". Since these are the system accounting logs, anyone who Just trims them really has not a clue of what is going on on their system!!!

If you want to know what is going on on your system I recommend to Administrators to enable accounting, and view accounting results before just removing them.

If you process accounting, the accounting processes zero out these files for you, convert to C format, and make some nice readable text for you. To setup accounting, do this.

>vi /etc/rc.config.d/acct
change START_ACCT=0 to START_ACCT=1
* this starts accounting at boot time.

Next, run "/usr/sbin/acct/startup" This will set things up, and turn on the accounting systems.

Next, vi /etc/acct/holidays. Probably only have to change the year, but you can setup quite a bit there.

Next add this entry to cron
01 00 * * * * /usr/sbin/acct/runacct;/usr/sbin/acct/ckpacct

runacct will run your daily accounting. ckpacct will check to see if disk is full, and disable accounting if it is.

Your easiest data to process by printing or paging is under /var/adm/acct/sum and will be called rprt$MM$DD where $MM is the 2 digit month, and $DD is the 2 digit day of the month.

It is recommended that you enable the accounting as the user "adm" and also have the user "adm" launch the accounting process scripts.

Of course, read the man pages, because the accounting is very powerfull, and provides a lot of information about activity on your system. Most of this information is in the reports, but there is alot in the raw C files too!

I find it quite amazing how many admins just blow away the accounting files, oblivious to the data they can provide! Especially when they can never say why things happen on their servers and complain about the OS!

Regards,
Shannon

[Bruce Regittko_1]

Hi,

Many respondants have suggested trimming the wtmp file to zero bytes. In my experience, 5 minutes after doing so you will want the data you just removed.

I suggest the following in a cron job:

cp /var/adm/wtmp /var/adm/wtmp.old
cat /dev/null > /var/adm/wtmp

Thus, if you run this monthly, you will always have at least one month's worth of data but never more than two.

--Bruce