What could possibly happen if wtmpx file got deleted by mistake?
Thanks,
the world, as we know it, might just stop to exist... or nothing...
as far as i remember the "last" log goes to this file?! so if this file is deleted, there is no last log...
I set up a cronjob to truncate this file on some servers,
> /var/adm/wtmpx
because I got bored doing it myself 
I've no idea who logged in now, but nothing bad ever happened.
scott likes to live "la vida loca"
Thanks all for your reply
Hmm. The dynamic record of who is logged in now is in utmpx . Don't mess with utmpx or the "who" command could not work.
The file wtmpx is historical connection information and the file used by unix command "last". It is a common dodge to routinely copy wtmpx to an archive filename and then null the original file as described. This does not break the process.
Actually deleting the wtmpx file is not a good idea. Many posts on this site describe deleting system accounting files and not getting the disc space back because the file is still open. Even after a reboot the file has to be created manually with the correct permissions to get system accounting running again.
Take care.
Totally agree, which is why I nulled the file (wtmp), and, as permissions go, why I would prefer
do_something > tmpfile
cp tmpfile orgfile && rm tmpfile
over
do_something > tmpfile
mv tmpfile orgfile
As for utmp... yes, best leave that be!
Personally I would null the file after copying the file rather than deleting the file.
We could check whether the file is open with unix command "fuser" but the output from this command is not consistent across platforms and it is easier to assume that the file is open.
Actually, my point there was a total aside from the main topic 
It was a general comment.
I did this once:
cd /etc
awk '/some blah/ { more blah }' rc.tcpip > rc.tcpip.tmp
mv rc.tcpip.tmp rc.tcpip
Not good.
Bye bye half your net services after a reboot (3 months later!)
I'd have got away with this:
cp rc.tcpip.tmp rc.tcpip && rm rc.tcpip.tmp