When I delete files such as /var/log/lastlog, /var/log/utmp and /var/log/wtmp the files will be recreated.

How do I disable the recreation of those files?

  • According to my information the generators of lastlog are hardwired in the kernel. Consequently, they can't be disabled.
    – Ketan
    Commented Feb 18, 2014 at 22:26
  • @Ketan Where in the kernel? And how about editting the kernel, since it is open source?
    – Pressnall
    Commented Feb 18, 2014 at 22:27
  • 1
    Do this instead: superuser.com/questions/410931/…
    – Ketan
    Commented Feb 18, 2014 at 22:33
  • 1
    Why would you want to do this? Commented Feb 18, 2014 at 23:10
  • 2
    @Ketan, the kernel has nothing to do with it. All those files are manipulated by numerous userspace tools.
    – Ricky
    Commented Feb 19, 2014 at 0:58

2 Answers 2


You can just link them to /dev/null. It will not generate errors like write-immutable solution above:

cd /var/log
for file in lastlog utmp wtmp ; do
  unlink $file
  ln -s /dev/null $file

I'm not sure why you would want to, but as Ketan said, they're hard wired into many parts of the system.

Instead you can truncate them, make them read-only and immutable.

# cat /dev/null > /var/log/lastlog
# cat /dev/null > /var/log/utmp
# cat /dev/null > /var/log/wtmp
# chmod ugo-w /var/log/lastlog /var/log/utmp /var/log/wtmp
# chattr +i /var/log/lastlog /var/log/utmp /var/log/wtmp

In order to be modified they'll need to have the immutable flag removed first.

  • It gets overwritten when you logout and login again
    – Pressnall
    Commented Feb 18, 2014 at 23:05
  • The immutable flag will prevent that. Immutability is all powerful.
    – bahamat
    Commented Feb 18, 2014 at 23:07
  • And immutable will cause write errors that can make all logins fail -- depending on your setup. The simpler answer is to symlink them to /dev/null. (there are too many tools that mess with them to try to disable them.)
    – Ricky
    Commented Feb 19, 2014 at 0:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .