LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-26-2013, 12:41 AM   #1
yashfire007
Member
 
Registered: Jan 2013
Distribution: CentOS, RHEL 6.4
Posts: 79

Rep: Reputation: Disabled
Question Deleting a line in wtmp file


Dear all,
Please tell me how to delete a line from wtmp file in /var/log/wtmp..
If i tried to view the file wtmp, it is in encrypted mode..
 
Old 01-26-2013, 12:53 AM   #2
shivaa
Senior Member
 
Registered: Jul 2012
Location: Grenoble, Fr.
Distribution: Sun Solaris, RHEL, Ubuntu, Debian 6.0
Posts: 1,800
Blog Entries: 4

Rep: Reputation: 286Reputation: 286Reputation: 286
It's not a text file but data type file, so prehaps removing one line isn't possible, but you can wipe it out:-
Code:
~$ file /var/log/wtmp
~$ last -f wtmp
~$ cat /dev/null > /var/log/wtmp
 
Old 01-26-2013, 12:57 AM   #3
yashfire007
Member
 
Registered: Jan 2013
Distribution: CentOS, RHEL 6.4
Posts: 79

Original Poster
Rep: Reputation: Disabled
Sorry dear, Actually i know to empty the file.
But what i need is, to delete a single line in that file...
 
Old 01-26-2013, 03:42 AM   #4
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 671Reputation: 671Reputation: 671Reputation: 671Reputation: 671Reputation: 671
Why do you want to edit wtmp?

http://linux.about.com/library/cmd/blcmdl5_wtmp.htm
Quote:
Warning: utmp must not be writable, because many system programs (foolishly) depend on its integrity. You risk faked system logfiles and modifications of system files if you leave utmp writable to any user.
utmp is a binary file whose structure is given in the utmp.h include file for your version of utmp.h.
 
2 members found this post helpful.
Old 01-26-2013, 07:09 AM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,335
Blog Entries: 55

Rep: Reputation: 3535Reputation: 3535Reputation: 3535Reputation: 3535Reputation: 3535Reputation: 3535Reputation: 3535Reputation: 3535Reputation: 3535Reputation: 3535Reputation: 3535
Quote:
Originally Posted by jschiwal View Post
Why do you want to edit wtmp?
Now that is the right question!
 
2 members found this post helpful.
Old 01-26-2013, 01:28 PM   #6
jpollard
Senior Member
 
Registered: Dec 2012
Location: Washington DC area
Distribution: Fedora, CentOS, Slackware
Posts: 4,661

Rep: Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256
utmp/wtmp is not supposed to be edited as it is a log of activity. Entries are created by privileged applications (by writing a partial record) then the record is completed with the application terminates.

Partial records imply that something significant happened that wasn't supposed to happen.

utmp/wtmp is also not exactly a reliable file - it only records terminal use (including X server and logins). But the records for gdm are almost always wrong (it puts entries in, but doesn't necessarily close them properly).
 
Old 01-26-2013, 10:24 PM   #7
yashfire007
Member
 
Registered: Jan 2013
Distribution: CentOS, RHEL 6.4
Posts: 79

Original Poster
Rep: Reputation: Disabled
Why i need the answer is because one of my friend knew the answer for this question.
He knew how to delete a single line from wtmp though it is a binary file.
He just challenged me to get the answer? But am trying a lot, even i cannot able to read the file..
Yes i know it is a critical file, but please tell me the solution for this. How to see and delete a single line which we wish to delete in wtmp.
 
Old 01-26-2013, 11:10 PM   #8
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 3,235

Rep: Reputation: 1402Reputation: 1402Reputation: 1402Reputation: 1402Reputation: 1402Reputation: 1402Reputation: 1402Reputation: 1402Reputation: 1402Reputation: 1402
There is a manpage for wtmp that shows the structure of the records in that file. The rest is up to you.
 
Old 01-27-2013, 06:35 AM   #9
jpollard
Senior Member
 
Registered: Dec 2012
Location: Washington DC area
Distribution: Fedora, CentOS, Slackware
Posts: 4,661

Rep: Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256
After looking up the structure, all you really need to do is use dd, and appropriate bye offsets.
 
Old 03-05-2016, 01:25 PM   #10
postcd
Member
 
Registered: Oct 2013
Posts: 409

Rep: Reputation: Disabled
There seems to be tools made to modify wtmp: https://packetstormsecurity.com/UNIX...on/log-wipers/
 
Old 03-05-2016, 03:09 PM   #11
jpollard
Senior Member
 
Registered: Dec 2012
Location: Washington DC area
Distribution: Fedora, CentOS, Slackware
Posts: 4,661

Rep: Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256Reputation: 1256
Quote:
Originally Posted by yashfire007 View Post
Why i need the answer is because one of my friend knew the answer for this question.
He knew how to delete a single line from wtmp though it is a binary file.
He just challenged me to get the answer? But am trying a lot, even i cannot able to read the file..
Yes i know it is a critical file, but please tell me the solution for this. How to see and delete a single line which we wish to delete in wtmp.
It is not a critical file. If it is deleted, a new one would get created.

It is used sometimes for accounting purposes, but even there, it isn't absolutely critical. It is only used
to collect a sequence of process accounting records into single "job".

Look at the manpage for wtmp. it is a random access file, and rather easily tampered with for the system admin.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Editing And Deleting A Line From A Text File Using Shell Script shiftshifter Linux - Newbie 6 07-13-2012 01:18 PM
deleting line by line from a file netpumber Programming 12 04-22-2010 07:22 AM
script for deleting matched line of a file from another file $Arsh Linux - Newbie 2 09-03-2009 07:38 AM
problem deleting file using solaris command line. szehanz Solaris / OpenSolaris 2 03-22-2005 07:52 PM
deleting a file via comman line PionexUser Linux - General 2 09-17-2003 12:27 AM


All times are GMT -5. The time now is 08:56 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration