Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Just noticed some 640MB wtmp file in a virtual container (Ubuntu Hardy).

# last -n 10000 -f /var/log/wtmp.1|wc -l
384
# ls -hl /var/log/wtmp.1
-rw-rw-r-- 1 root utmp 641M 21. Sep 07:49 /var/log/wtmp.1

logrotate was not installed (I just did that and forced rotating).

Are there records in there not being displayed by last (which should show the last 1000 entries, but apparently there are only 384).

From quickly skimming the wtmp/utmp man page, it does not look like a single entry should use about 1,6MB.

Is there another program besides last to inspect these files?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

logrotate was a good idea.

Like any regular file, wtmp could have been "sparse" (cf. lseek(2) "holes" and ls -s) which can show a extreme file size that actually occupies little disk. How did the hole get there, if it was a hole? getty(8) and friends could have had a bug. Or a system crash and fsck repair could have caused it.

If you are looking to see the raw contents of wtmp, od or hd are good for peeking at binaries and have the happy side effect of showing long runs of empty as such.

Unless it recurs, I wouldn't give it much more thought. A marginally competent intruder would do a better job than that, the contents aren't all that interesting, and little depends on them.

share|improve this answer
    
The file does not appear to be sparse: here is the beginning of the new file (already 23MB): pastebin.com/NFtnyUJU If I understand this correctly, it looks like a bunch of logins? (6=LOGIN_PROCESS). The machine is a OpenVZ container, running BOINC (distributed computing), so this might be just as expected. There was another machine with a huge wtmp file (phpmyadmin, web server), where the output of hd looks more odd: pastebin.com/1UtxYudE –  blueyed Sep 22 '10 at 11:21

Just to help others which might find this useful...

Is there another program besides last to inspect these files?

Yes, try utmpdump.

$ utmpdump /var/log/wtmp
share|improve this answer

If you doubt the wtmp might have holes you could get rid of them with cp --sparse if you have new enough coreutils, or with fallocate --dig-holes if you use yet not released util-linux 2.25 version. Perhaps more practical approach is to repack the wtmp.

utmpdump /var/log/wtmp | utmpdump -r > /tmp/newtmp
ls -l /var/log/wtmp /tmp/newtmp # if significantly smaller
chown root:root /tmp/newtmp
chmod 0554 /tmp/newtmp
mv /tmp/newtmp /var/log/wtmp

And if even then the file is rather large then just rotate & compress.

mv /var/log/wtmp{,.1}
gzip -9 /var/log/wtmp.1
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.