• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer navigation

The Geek Diary

  • OS
    • Linux
    • CentOS/RHEL
    • VCS
  • Interview Questions
  • Database
    • MariaDB
  • DevOps
    • Docker
    • Shell Scripting
  • Big Data
    • Hadoop
    • Cloudera
    • Hortonworks HDP

CentOS / RHEL : How to rotate /var/log/wtmp and /var/log/btmp file using logrotate

by admin

The login records for the ‘last‘ command are kept in a data file ‘/var/log/wtmp‘. The command ‘last’ parses this data file and gives back the output. There is also a provision for another data file ‘/var/log/btmp‘ to be created to store bad logins, which can be read using the command ‘lastb‘.

Using logrotate to rotate the wtmp/btmp files

To prevent a large volume of log files from filling up the ‘/var/log’ filesystem, there is a facility called as logrotate. A daily cron job calls this logrotate into action once a day. Logrotate consults its configuration file ‘/etc/logrotate.conf’ for instructions on which log files have to be rotated and when.

Logrotate’s configuration file is ‘/etc/logrotate.conf‘. Logrotate handles the rotation of /var/log/wtmp. As wtmp is not owned by a specific package, its logrotate configuration is not in /etc/logrotate.d but directly in /etc/logrotate.conf.

Here is the default configuration:

/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 1
}

To make wtmp rotate more frequently (therefore preventing it to grow too much) change the frequency of the rotation from monthly to weekly and/or set a size-based threshold for rotation.

Examples of logrotate configurations
1. To have one years login information on your system, edit ‘/etc/logrotate.conf’ to have below configuration:

/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 1
}

Either change the ‘monthly’ rotation to ‘yearly’, or keeping it at ‘monthly’ and change the rotate count to 13, as shown below.

/var/log/wtmp {
    yearly
    create 0664 root utmp
    rotate 1
}

or

/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 13
}

Reading the old wtmp files

To have the ‘last’ command read from an old rotated file, run the command as shown below:

# last -f [path to rotated file]

Filed Under: Linux

Some more articles you might also be interested in …

  1. dash: Debian Almquist Shell, a modern, POSIX-compliant implementation of sh
  2. ex: Command-line text editor
  3. aws configure – Manage configuration for the AWS CLI (Command Examples)
  4. How to use strace and ltrace commands in Linux
  5. grub-bios-setup Command Examples in Linux
  6. cuyo: command not found
  7. pvcreate Command Examples in Linux
  8. dpkg Command Examples in Linux
  9. “az appconfig”: Manage App configurations on Azure (Command Examples)
  10. df: command not found

You May Also Like

Primary Sidebar

Recent Posts

  • Vanilla OS 2 Released: A New Era for Linux Enthusiasts
  • mk Command Examples
  • mixxx Command Examples
  • mix Command Examples

© 2025 · The Geek Diary

  • Archives
  • Contact Us
  • Copyright