cleaning up /var/adm/wtmp

Risc91 · 07-15-2004, 09:13 AM

I have a box that had accounting enabled, but was forgotten about by a previous admin and as a result has a rather large wtmp file. Does anyone know of a perl script (or other) that will allow me to clean this file up?

I have found one, but it doesn't seem to be using the same format wtmp file. It doesn't account for all the fields in the wtmp file on the aix boxes.

I do not want to annihilate the whole file using cp /dev/null.

TIA

zorba4 · 07-15-2004, 04:07 PM

Just for fun, I would
1) backup wtmp, just in case : mv wtmp wtmp.first
2) tail -100 wtmp.first >wtmp.
3) if this did the job
then
thanks Zorba
else
sorry

mpdavig · 07-16-2004, 01:43 PM

I would install logrotate 3.6.8 or above and rotate the file once a week. It is common to most Linux distributions and compiles nicely on AIX.

If interested I have a binary and source AIX rpm I can send you.

iainr · 07-17-2004, 01:41 AM

Although it doesn't affect wtmp, AIX has log rotation built in for syslog - you just specify in /etc/syslog.conf

Code:

[rotate [size <size> k|m] [files <files>] [time <time> h|d|w|m|y] [compress] [
archive <archive>]] is:
#       If <destination> is a regular file and the word "rotate" is
#       is specified, then the <destination> is limited by either
#       <size> or <time>, or both <size> and <time>. The <size> causes
#       the <destination> to be limited to <size>, with <files> files
#       kept in the rotation. The backup filenames are created by
#       appending a period and a number to <destination>, starting with
#       ".0". The <time> causes the <destination> to be rotated after
#       <time>. If <time> is specified, the backup filenames are created
#       by appending the date and time to <destination>, in the format
#       YYYYmmmdd:HH:MM:SS where:
#       YYYY = year
#       mmm  = name of the month
#       dd   = day
#       HH   = hour
#       MM   = minutes
#       SS   = seconds
#       If both <size> and <time> is specified, and the <size> causes
#       the log to rotate, then the backup filenames will be created
#       by appending both the date and time and a period and a number to
#       <destination>.
#       The minimum size that can be specified is 10k, the minimum
#       number of files that can be specified is 2. The default
#       size is 1m (meg) and the default for <files> is unlimited.
#       Therefore, if only "rotate" is specified, the log will be
#       rotated with <size> = 1m.
#       The compress option means that rotated log files that are not
#       in use will be compressed.
#       The archive option will save rotated log files that are not
#       in use to <archive>.
#       The default is not to rotate log files.
# Example : 
#  *.debug              /tmp/syslog.out     rotate size 100k files 4

screwloose · 07-19-2004, 03:51 PM

#!/usr/bin/perl
truncate("/var/adm/wtmp",1000)

**Note: 1000 is an arbitrary number and truncates the file to N bytes.

Yegolev · 08-23-2004, 09:52 AM

#!/bin/ksh
# the IBM-approved method, more or less
# keep 10000 lines by default
let keep=${1:-10000}
/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/out
tail -n $keep /tmp/out > /tmp/trunc
/usr/sbin/acct/fwtmp -ic < /tmp/trunc > /var/adm/wtmp