trimm /var/adm/wtmps

[Ignite_2]

Hi guys,

we have an HP-UX box, where space consumed by wtmps file is almost 500MB. I'll trimm this file, but first need to make an acsii backup of that.

I have followed the procedure and converted binary database into an ascii file. Problem here is, that even ascii file is not readable.

Have you an experience with something like that?

[Uday_S_Ankolekar · Accepted solution]

You can copy wtmp as wtmp.old (if you really wants to keep that file)
you can use last command to read it..
last -f wtmp.old

use cat /dev/null >/var/adm/wtmp to create new wtmp
-USA..

[James R. Ferguson]

Hi:

> Problem here is, that even ascii file is not readable.

How is it not readable? If you mean that the file is too large for 'vi' then say that. Is it?

Regards!

...JRF...

[Ignite_2]

Hi,

maybe it's too large. But, shouldn't it be readable using "cat" or "more"?

vi has opened the file for me, but the content was in same unreadable format as using "more".

[Michael Steele_2]

I'm stunned that you want to make an ascii backup. What's wrong with a binary backup when the 'last -f old_filename' command is all you need?

'last' is really the only command that relies upon /var/adm/wtempx. Note the 'x', and not the 's'.

Use can try 'strings' command on binary files, and,

You've mispelled /var/adm/wtmps, it should be either /var/adm/wtmp, which is obsolete /var/adm/wtmpx which has replaced wtmp and is what you should be looking at. (* I believe *)

See man page for 'last' or wtmp or wtmpx.

[Michael Steele_2]

I'm sorry, and stunned at my self for giving you information about wtmp and wtpmx that applies to solaris and not hp-ux.

Please disregard those comments.

Thanks!

[Ignite_2]

Hi,

I just made a fresh copy of wtmps to test functionality of last -f ...

# cp wtmps /tmp/wtmps.backup
# last -f /tmp/wtmps.backup
pid exceeds MAXPID: wtmp file corrupted

- how could it be corrupted, when running "last" without specifying file works. ..but:

# last -f /var/adm/wtmps | more
pid exceeds MAXPID: wtmp file corrupted

[Hiren N Dave]

> Problem here is, that even ascii file is not readable
you can use 'strings' command to view binary files, but it will only show readable texts...use last command instead...

> but first need to make an acsii backup
no need to take ascii backup, just move the file with date postfix for future reference and echo /dev/null the original file..

> pid exceeds MAXPID: wtmp file corrupted
may be the file is corrupted... try on fresh file.. it should work just fine...


> we have an HP-UX box, where space consumed by wtmps file is almost 500MB
use below script to trim the file regularly using cron jobs

TMP=/var/adm/wtmp/wtmp_`date +%d`_`date +%m`_`date +%Y`_`date +%H`_`date +%M`.log
cp -f -p /var/adm/wtmp.log $TMP

[VK2COT]

Hello,

Apart from various Shell scripts,
why not use logrotate:


http://hpux.connect.org.uk/hppd/hpux/Sysadmin/logrotate-3.7.9/

Here is what I use for logrotate.conf
on my HP-UX servers:

# sample logrotate configuration file
compress

/var/adm/syslog/syslog.log {
rotate 5
weekly
postrotate
/usr/bin/kill -HUP `cat /var/run/syslog.pid`
endscript
}

/var/adm/syslog/mail.log {
rotate 5
weekly
postrotate
/usr/bin/kill -HUP `cat /var/run/syslog.pid`
endscript
}

/var/adm/syslog/vseassist.log {
rotate 12
monthly
missingok
}

/var/adm/sw/swverify.log {
rotate 5
weekly
postrotate
/sbin/init.d/swagentd stop
/sbin/init.d/swagentd start
endscript
}

# no packages own wtmp -- we'll rotate them here
/var/adm/wtmp {
monthly
create 0664 adm adm
rotate 12
}

/var/adm/wtmps {
monthly
create 0664 adm adm
rotate 12
}

/var/opt/wbem/*.log {
monthly
rotate 2
olddir /var/opt/wbem/prevmonth
missingok
postrotate
/sbin/init.d/cim_server stop
/sbin/init.d/cim_server start
endscript
nocompress
}

Cheers,

VK2COT

[Dennis Handly]

>I have followed the procedure and converted binary database into an ascii file.

What procedure? fwtmp(1M)?

>that even ascii file is not readable.

Then your procedure is wrong.

>last -f /tmp/wtmps.backup
pid exceeds MAXPID: wtmp file corrupted

You need to read last(1) carefully. You also need -X.

>how could it be corrupted, when running "last" without specifying file works.

Because last(1) is "broken" and didn't change its default work on wtmps files with -f.