last log

ust · 02-17-2009, 07:59 PM

I know the command "last" can show the user login record , so now when I use this command , it shows the user login record in this half year ( I didn't clear it for half year ) , can advise if I want clear the old record so that it only show the record from 1-feb-09 ( that mean clear the record before 1-feb-09 ) , what can i do ?

trist007 · 02-17-2009, 09:04 PM

Find out what file that database is located in, use google. Then you could completely clear it by

echo "" > database.txt

or you could run a special script delete all the records except the ones in feb 09. Or depending on the size of the file, run

ls -l database.txt

if the size of the file is a lot less that your ram, you could just try running kedit, then open the file and edit it manually. The filename probably isnt' called database.txt, just using that as an example.

ust · 02-17-2009, 09:48 PM

Quote:

Originally Posted by trist007

Find out what file that database is located in, use google. Then you could completely clear it by

echo "" > database.txt

or you could run a special script delete all the records except the ones in feb 09. Or depending on the size of the file, run

ls -l database.txt

if the size of the file is a lot less that your ram, you could just try running kedit, then open the file and edit it manually. The filename probably isnt' called database.txt, just using that as an example.

I find the lastlog , you mean try echo lastlog > database.txt ? I tried it but not work...

thx

trist007 · 02-17-2009, 09:52 PM

to clear the lastlog of all entries do

echo "" > lastlog

ust · 02-19-2009, 01:03 AM

Quote:

Originally Posted by trist007

to clear the lastlog of all entries do

echo "" > lastlog

thx reply ,

I am not want to clear it , I just want to erase the data before 1-feb , can advise what can i do ? thx

ust · 02-19-2009, 01:50 AM

I know I can use last -f wtmp to export the file to text , then I can modify it , but how can I import back it to current wtmp ?

colucix · 02-19-2009, 02:23 AM

You can truncate the file wtmp using the tail command, even if it is a binary file. First do a backup of the original wtmp file somewhere. Then you can try the tail command choosing an arbitrary number of lines (e.g. 100) redirecting the output to a file. Then substitute the original wtmp with the newly created file and try the last command. You can adjust the number of lines to truncate until you reach the 1st of February as the first record in the file. Unfortunately there is no correspondence between the number of lines in the output of last and the number of line in the wtmp file, so that you have to retry until you reach the desired size.

To avoid this handy method in the future, you can setup a logrotate script to manage the wtmp file, for example by rotating it once a month.

skipdashu · 04-30-2009, 01:35 AM

Quote:

Originally Posted by colucix

To avoid this handy method in the future, you can setup a logrotate script to manage the wtmp file, for example by rotating it once a month.

Glad you brought this up. I have a file called boinc.log in /home/boinc/BOINC/

I created a file called boinc in /etc/logrotate.d/

The file looks like this:

Code:

/home/boinc/BOINC/boinc.log {
  daily
  compress
  missingok
  notifempty
}

For this machine the logrotate.conf is:

Code:

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 3 weeks worth of backlogs, SRG 2009/4
rotate 3

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}

My problem is that boinc.log is not rotating but I don't see any problem in the config files. Is there something else I need to do?

colucix · 04-30-2009, 02:13 AM

It looks correct. Try to manually run logrotate (usually it runs automatically from the daily crontab):

Code:

/usr/sbin/logrotate /etc/logrotate.conf

You can try the -f option, too. According to the man page of logrotate:

Code:

-f, --force
      Tells  logrotate to force the rotation, even if it doesn’t think this is necessary.  Sometimes
      this is useful after adding new entries to logrotate, or if old log files have been removed by
      hand, as the new files will be created, and logging will continue correctly.

skipdashu · 05-01-2009, 01:20 AM

Quote:

Originally Posted by colucix

It looks correct. Try to manually run logrotate (usually it runs automatically from the daily crontab):

Code:

/usr/sbin/logrotate /etc/logrotate.conf

You can try the -f option, too. According to the man page of logrotate:

Code:

-f, --force
      Tells  logrotate to force the rotation, even if it doesn’t think this is necessary.  Sometimes
      this is useful after adding new entries to logrotate, or if old log files have been removed by
      hand, as the new files will be created, and logging will continue correctly.

Yup, just needed a kick in the butt... I ubuntuized the command (lol) to:

Code:

sudo logrotate -f /etc/logrotate.conf

Thanx much,
Skip

colucix · 05-01-2009, 02:35 AM

He he... "ubuntuized the command" is really nice!