/var/adm/wtmp

[Waqar Razi]

I have a question about /var/adm/wtmp file. Is it important file? What sort of information does it contain? Is it safe to trim the file?

My var is getting full and this file occupies around 20 mb of space on it, I am trying to trim it through SAM but SAM does not have any recommneded size for this file as it is nonascii, Can I trim it to 0 size?

[Robert-Jan Goossens]

Hi,

have a look at this thread.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=69415

Regards,
Robert-Jan

[James R. Ferguson · Accepted solution]

Hi:

The 'wtmp' file holds login information that you may or may not care to log. If the file is wholly removed, logging ceases.

The file is a binary file and as such can be read with 'last' (see the manpages).

You can null the file and resume logging from an empty file by doing:

# cat /dev/null > /var/adm/wtmp

If you want to trim the file and retain some subset of records, do:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

...edit...

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

A "cousin" of 'wtmp' is 'btmp' which logs "bad" logins.

Regards!

...JRF...