Just noticed some 640MB wtmp file in a virtual container (Ubuntu Hardy).
# last -n 10000 -f /var/log/wtmp.1|wc -l 384 # ls -hl /var/log/wtmp.1 -rw-rw-r-- 1 root utmp 641M 21. Sep 07:49 /var/log/wtmp.1
logrotate was not installed (I just did that and forced rotating).
Are there records in there not being displayed by
last (which should show the last 1000 entries, but apparently there are only 384).
From quickly skimming the
wtmp/utmp man page, it does not look like a single entry should use about 1,6MB.
Is there another program besides
last to inspect these files?