From: izumi@pinoko.berkeley.edu (Izumi Ohzawa)
Newsgroups: comp.sys.next.sysadmin
Subject: Re: how to purge wtmp file
Date: 9 Sep 1992 00:55:28 GMT
Organization: University of California, Berkeley
Distribution: world
Reply-To: izumi@pinoko.berkeley.edu
NNTP-Posting-Host: moica.berkeley.edu

In article <1992Sep8.174653.3657@essex.com> steved@essex.com writes:
>I just noticed my /private/wtmp file today (and some other fairly large files  
>in /private/adm).  These seem to grow indefinitely....
>
>I reviewed the man pages but didn't find an easy way to manage these files, but  
>in poking around in /private/tmp I found the "monthly" and "weekly" shell  
>scripts.  I ran these manually and they seemed to pare down the nasty files (my  
>machine is not networked, so I don't need all the otherwise neat history in  
>these files) Does anyone use these shell scripts, and if so, how do you set  
>them up in crontab?

Hopefully, this post is short enough not to elicit any complaint from the net police.

It's already setup in /etc/crontab.  But it just wipes out the whole wtmp to
zero length on the first of every months.  The following is a much nicer program
which does the paring by keeping only the last N records in wtmp file.
Modify /usr/adm/monthly to:

# Trim wtmp to the last 2000 entries
/usr/local/bin/wtmptrim 2000

----- cut here --------------------------------------------------------------
/* wtrim.c -- /usr/adm/wtmp file trimmer 
** by Michael Galassi -- nerd@percival.rain.com
** this is public domain, you can even say you wrote it,
** I don't care compile with:
**       cc -ansi -O wtrim.c -o wtrim -object -s
*/

#include <stdio.h>
#include <stdlib.h>
#include <utmp.h>
#include <sys/file.h>
#include <sys/stat.h>

#define WTMP "/usr/adm/wtmp"
#define OWTMP "/usr/adm/wtmp.old"
#define DEFTRIM 2000

void main(int argc, char *argv[])
{
        int size;
        int fd;
        struct stat st;
        struct utmp *ptr;

        if (argc == 2)
                size = atoi(argv[1]) * sizeof(struct utmp);
        else if (argc == 1)
                size = DEFTRIM * sizeof(struct utmp);
        else {
                fprintf(stderr, "usage: %s [count]\n", argv[0]);
                exit(1);
        }
        if (stat(WTMP, &st) < 0) {
                fprintf(stderr, "%s: can't stat " WTMP "\n", argv[0]);
                exit(1);
        }
        if (st.st_size <= size)         /* already OK */
                exit(0);
        if ((fd = open(WTMP, O_CREAT|O_RDWR, 0644)) < 0) {
                fprintf(stderr, "%s: can't open " WTMP "\n", argv[0]);
                exit(1);
        }
        if (lseek(fd, st.st_size - size, L_SET) != st.st_size - size) {
                fprintf(stderr, "%s: can't lseek in " WTMP "\n", argv[0]);
                close(fd);
                exit(1);
        }
        if ((ptr = (struct utmp *) malloc(size)) == (void *)NULL) {
                fprintf(stderr, "%s: can't malloc %d bytes\n", argv[0], size);
                close(fd);
                exit(1);
        }
        if (read(fd, ptr, size) != size) {
                fprintf(stderr, "%s: can't malloc %d bytes\n", argv[0], size);
                free(ptr);
                close(fd);
                exit(1);
        }
        close(fd);
        unlink(OWTMP);
        if (rename(WTMP, OWTMP) < 0) {
                fprintf(stderr, "%s: can't rename " WTMP " to " OWTMP "\n", argv[0]);
                free(ptr);
                exit(1);
        }
        if ((fd = open(WTMP, O_CREAT|O_WRONLY, 0644)) < 0) {
                fprintf(stderr, "%s: can't open new " WTMP "\n", argv[0]);
                free(ptr);
                rename(OWTMP, WTMP);
                exit(1);
        }
        if (write(fd, ptr, size) != size) {
                fprintf(stderr, "%s: can't write new " WTMP "\n", argv[0]);
                free(ptr);
                close(fd);
                unlink(WTMP);
                rename(OWTMP, WTMP);
                exit(1);
        }
        close(fd);
        free(ptr);
        exit(0);
}
---- cut here -----------------------

--
Izumi Ohzawa             [ $BBg_78^=;(J ]
USMail: University of California, 360 Minor Hall, Berkeley, CA 94720
Telephone: (510) 642-6440     Fax:  (510) 642-3323
Internet: izumi@pinoko.berkeley.edu (NeXT Mail OK)