Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to clear the last -10 information only for a Linux system? I tried to execute the command > /var/log/wtmp to clear the last info, but it clears the whole login info , but I need to clear only last -10 login info.

share|improve this question
What are you some kind of evil H4xx0r? Why would you want to clear out the logs that are there for security auditing? – Zoredache Mar 14 '12 at 0:48
up vote 5 down vote accepted

The wtmp file is a sequence of struct utmp records. To remove the last 10 records, you first discover the size of a utmp record, then you truncate the wtmp file to its current size minus the ten times the size of a utmp record.

A simple C program will give you the size of a utmp record.

#include <utmp.h>
#include <stdio.h>

struct utmp foo;

    printf("%lu\n", sizeof foo);
    return 0;

and a Perl script will truncate the wtmp file

$utmp_size = utmp_record_size_goes_here;
$wtmp_file = "wtmp filename goes here";
open WTMP, "+<", $wtmp_file or die "$wtmp_file: ", $!;
seek WTMP, -10 * $utmp_size, 2;
truncate WTMP, tell(WTMP);
close WTMP;
share|improve this answer
Thanks, is there any simple command for it. – Mughil Mar 13 '12 at 6:04
@Mughil: Kyle has presented the "not-so-simple" part, and it works quite nicely (on a test text file). What is it that isn't simple enough? Perhaps it is compiling the c program? That requires utmpc=~/bin/utmpsize.c; gcc -o "${utmpc%.c}" "$utmpc" 2>/dev/null && chmod +x "${utmpc%.c}"... then you just fill in the "goes_here" parts of the first 2 lines of the perl script, add a hash-bang header, eg: #!/usr/bin/perl, then make it executable via: chmod +x perl-script-name and just run the perl script. You could alternatively use truncate, but that needs the file and struct sizes. – Peter.O Mar 13 '12 at 7:11
@Peter truncate accepts negative size increments, so it is enough to know only sizeof(struct utmp). – user21564 Aug 2 '12 at 16:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.