trimming wtmp - log file size

[Dee_3]

Is there a way to automatically trim wtmp without writing a cron for it. Is there a way to define a log file so that it rolls over to a .old on reaching a certain size or trims the old data to keep the file at a constant size?

[Jason VanDerMark · Accepted solution]

You can setup a size limit within sam which will automatically trim the log files for you. You can do this from sam / routine tasks / system logs. Then just select the wtmp log which is located in /var/adm/wtmp and set a size for it. Hope this helps.

Regards,
Jason V.

[Rita C Workman]

I suppose you'd have to write a script for what you mention. But the question is usually what is the right way to trim/cleaup wtmp since there is active login info in there...here's a couple threads on it:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0xfdebf841489fd4118fef0090279cd0f9,00.html

http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0x4cb66af52b04d5118fef0090279cd0f9,00.html

/rcw

[Jason VanDerMark]

If you do not have a recomended size set for the wtmp log file you can remove it, then re-add it and assign it a recommended size. I haven't found an easy way from the terminal text gui to set it if it is marked N/A. Just thought I would pass that on to you.

Good Luck,
Jason V.

[Jason VanDerMark]

Doh! ***Slap Head*** It didn't even dawn on me that we were talking about wtmp... fingers typed before communicating with brain. Sorry bout that.

[Shannon Petry]

An easy way to trim the wtmp file is by running daily accounting.
man acct

This however creates logs of output for Admins to review. It is advisable to remove these instead of wtmp via a cron job.

I gave a pretty detailed description a while ago about how to set up berkely accounting. Search for it for more info. I use acct at all facilities not just to keep wtmp and the other acct files tidy, but to gather information.

Regards,
Shannon

[James R. Ferguson]

Hi Dee:

Shannon is right. The accounting facilities are designed to manage /var/adm/wtmp when you are interested in keeping, analyzing, and trimming the data.

If you merely want to "zero" the file after examining it (with 'last') then the proper way is to direct /dev/null into it so that the file descriptor to the file remains the same:

# cat /dev/null > /var/adm/wtmp

If you never care about last logins, you can remove the file entirely. This will stop its creation and any I/O to it. Then, if you want to use it later, touch it (or direct /dev/null to it); set its ownership to "root" and make its permissions 644.

Take a look at the 'last' man pages for more information, too.

...JRF...

[Dee_3]

Thanks for all the suggestions - gives me several options to play with...deec

[Paula J Frazer-Campbell]

Hi Dee

Please assign points to those that helped you,

http://europe-support2.external.hp.com/estaff/bin/doc.pl/forward/screen=estaffAssistance/sid=e1247fa4196e98c369?Page=file0002#forpoints


Paula

[Dee_3]

Sorry to take so long in assigning points - I was running late Friday so I wanted to let you all know that I appreciated the information - but then did not take the time to assign points - will do so immediately! deec