How to clear the last -10 info?

Question

How to clear the last -10 information only for a Linux system? I tried to execute the command > /var/log/wtmp to clear the last info, but it clears the whole login info , but I need to clear only last -10 login info.

Answer 1

The wtmp file is a sequence of struct utmp records. To remove the last 10 records, you first discover the size of a utmp record, then you truncate the wtmp file to its current size minus the ten times the size of a utmp record.

A simple C program will give you the size of a utmp record.

#include <utmp.h>
#include <stdio.h>

struct utmp foo;

main()
{
    printf("%lu\n", sizeof foo);
    return 0;
}

and a Perl script will truncate the wtmp file

$utmp_size = utmp_record_size_goes_here;
$wtmp_file = "wtmp filename goes here";
open WTMP, "+<", $wtmp_file or die "$wtmp_file: ", $!;
seek WTMP, -10 * $utmp_size, 2;
truncate WTMP, tell(WTMP);
close WTMP;