Hi Stefann
... I feel the wtmp rotation can be converted similarly in a 1 line command. I will be able to figure that out. Just following the logic of the other command. ...
Maybe something like this:
Entries=100 ; tail -c $(($Entries*384)) /var/log/wtmp > NewWtmp && sudo mv NewWtmp /var/log/wtmp
Just change the value of Entries to how much history you wish to retain.
Just for the record, the number of entries that the "last" command reports
may not match FileSize/384. It seems when you close a terminal, that action
gets logged, but "last" does not report it.
Here I trim wtmp to 10 entries:
Entries=10 ; tail -c $(($Entries*384)) /var/log/wtmp > NewWtmp && sudo mv NewWtmp /var/log/wtmp
This is what last reports:
tc@E310:~$ last -F -f /var/log/wtmp
tc pts/8 :0.0 Mon Oct 14 10:45:55 2024 - Mon Oct 14 10:45:57 2024 (00:00)
tc pts/7 :0.0 Mon Oct 14 09:22:07 2024 still logged in
tc pts/7 :0.0 Mon Oct 14 08:37:22 2024 - Mon Oct 14 09:22:07 2024 (00:44)
tc pts/7 :0.0 Sun Oct 13 08:26:48 2024 - Sun Oct 13 12:26:17 2024 (03:59)
tc pts/5 :0.0 Sun Oct 13 08:17:32 2024 still logged in
tc pts/5 :0.0 Sat Oct 12 09:32:51 2024 - Sat Oct 12 09:46:46 2024 (00:13)
tc pts/5 :0.0 Wed Oct 9 21:51:27 2024 - Sat Oct 12 09:32:51 2024 (2+11:41)
wtmp begins Wed Oct 9 21:51:27 2024
tc@E310:~$
It shows 7 entries.
Using the perl script found at the link in reply #5 I get this:
tc@E310:~$ ./ReadWtmp.sh < /var/log/wtmp | sort -r -k 3
Mon Oct 14 10:45:57 2024 Term tc pts/8 :0.0
Mon Oct 14 10:45:55 2024 Normal tc pts/8 :0.0
Mon Oct 14 09:22:07 2024 Normal tc pts/7 :0.0
Mon Oct 14 08:37:22 2024 Normal tc pts/7 :0.0
Sun Oct 13 12:26:17 2024 Term tc pts/7 :0.0
Sun Oct 13 08:26:48 2024 Normal tc pts/7 :0.0
Sun Oct 13 08:17:32 2024 Normal tc pts/5 :0.0
Sat Oct 12 09:46:46 2024 Term tc pts/5 :0.0
Sat Oct 12 09:32:51 2024 Normal tc pts/5 :0.0
Wed Oct 9 21:51:27 2024 Normal tc pts/5 :0.0
tc@E310:~$
It shows 10 entries.
Note the two pts/8 entries. That was me opening then closing a terminal.
The last command only reports me opening the terminal at 10:45:55.
Just wanted to point that out in case anyone else notices that discrepancy.