Just noticed some 640MB wtmp file in a virtual container (Ubuntu Hardy).
# last -n 10000 -f /var/log/wtmp.1|wc -l
384
# ls -hl /var/log/wtmp.1
-rw-rw-r-- 1 root utmp 641M 21. Sep 07:49 /var/log/wtmp.1
logrotate was not installed (I just did that and forced rotating).
Are there records in there not being displayed by last
(which should show the last 1000 entries, but apparently there are only 384).
From quickly skimming the wtmp/utmp
man page, it does not look like a single entry should use about 1,6MB.
Is there another program besides last
to inspect these files?