stop wtmp logging

[Dave Bunting]

Hi,

How do I stop wtmp from logging?

i zeroed /var/adm/wtmp [cat /dev/null] but it keeps on growing... how do i stop this?



Thanks

Dave

[Animesh Chakraborty · Accepted solution]

Hi,
The file /var/adm/btmp contains bad login entries for each invalid logon
attempt and the file /var/adm/wtmp contains a record of all logins and
logouts. See the man page utmp(4) for more information.

They are binary data files, so they cannot be read directly. The can however
be read with the following commands:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp
# /usr/sbin/acct/fwtmp < /var/adm/btmp

The "last" and "lastb" commands display the information is a readable format.

The files can be zeroed or removed but if they are removed they need to be
manually recreated as they not created by the programs that maintain them.
Thus, if these files are removed, record-keeping is turned off.

If you want to recreate them note the ownerships and permissions before
removing them and reset the ownerships and permissions after recreating the
files (usually with touch to create an empty files). This is EXTREMELY
important -> especially for the btmp file.
HP ONLY

[Michael Tully]

Hi,

One of the easiest ways is to do this through
sam.

sam --> routine tasks -->
system log files --> choose /var/adm/wtmp
choose actions --> trim -->
trim to zero
exit SAM and then remove the file.
This should fix it.

-Michael

[T. M. Louah]

Just adding to above, /var/adm/wtmp and /var/adm/btmp files tend to grow without bound (until they fill up the filesystem). These data files contain encoded information, so it is generally not useful to read them directly. The last(1) and lastb(1) commands display this log information in a plain text format.

[Printaporn_1]

why you want to stop wtmp from logging , it useful but in 10.20 it can be so big , just manage it size using as someone state above.