sulog question

[Nick Lewers]

It appears as if the sulog is cleared on system start. Is there a way to not clear that file on startup? Also, what is the best way to clear wtmp/btmp to keep say the last year of entries?

[James R. Ferguson · Accepted solution]

Hi Nick:

The 'sulog' is moved to 'OLDsulog' during startup.

As for 'wtmp' and/or 'btmp', transform these into an Ascii text file:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

Now, either retain this version, or edit the contents and re-create a modified parent:

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

Regards!

...JRF...

[Pete Randall]

As James points out, the sulog is renamed during startup. The script that does this is /sbin/init.d/clean_adm. You could easily modify this to do whatever you desire.


Pete

[Court Campbell]

As mentioned the file is just moved. If you want to disable the move you can edit the script /sbin/init.d/clean_adm, or you could disable the script from running in /etc/rc.config.d/clean. But I will leave the decision to you. In my case I turned it off because I have a perl script that does the log rotation.

[Nick Lewers]

thanks for the quick replies, will probably just disable it from being cleaned out as I was told to keep it in perpetuity.

the wtmp/btmp information is also quite helpful.