wtmpx

UNIX for Beginners Q & A UNIX for Dummies Questions & Answers
1

Platform sol 8

I had wtmpx growing very large(1.2 G). I copied the file and compressed it the did a "cat /dev/null > /var/adm/wtmpx" to zero out the file and not close any doors to any processes. (After searching this seemed like the right method)

This is a box that gets accessed from other programs every 10 mins or so, which I expect that's why wtmpx grows so rapidly(1 gig in 2 months).

My question - is wtmpx just used for accounting (billing login time) and is it necessary to have or can it be disabled without any security issues? I know I can write a cron to clear it out(if this is the correct method) but if the box is not going to be used in an accounting way do I even need it to log this?

2

wtmpx is used for more than accounting. I don't know what would happen if its missing, but I *think* that it would just be recreated.

A few commands that need it...

init
login
date
last
who

that's a lot of stuff to risk breaking.

3

Should I save a copy before I "cat /dev/null " the file. If I need to keep a copy how can I read it and why? To check for security issues?

Also is this a proper method to clear the file and set up in a cron job?

4

With any log file, I usually keep some stuff. So I might effectively do something like:

mv wtmpx.2 wtmpx.3
mv wtmpx.1 wtmpx.2
cp wtmpx wtmpx.1
> wtmpx

But actually, it's been years since I've done stuff like that. There are log rotation tools that are very good and they are available for free. I like newsyslog. But there are others. See Log Rotation Tool/Script for some options. We have many other threads on this topic. Use our search function.

You can read wtmpx files with "who" or "last". See the man pages.

5

Thanks, I will give it a try.

You used "> wtmpx"....is this better/same as using " cat /dev/null >var/adm/wtmpx"?

Does it matter? (I know you have to leave the pipe open to the file else restart a process but other than that I'm in the dark).

6

Both yield the same result. But
cat /dev/null > wtmpx
causes the shell to fork a copy of itself, open /dev/null, and exec the cat program. That's all needless activity.