question on

by typing the command last it displays all the users that have ever been on my machine from a certain time. At this time, it's almost a year ago. Is it safe to delete the /etc/wtmp or /var/adm/wtmp files, or are these files something I shouldn't be messing with? thanks

Most reduce these files by "cat /dev/null > utmp" after backing them up or rotating them out. Some others use the Solaris command fwtmp to truncate all entries in the files prior to a specified date.

here is something helpful from sun on the subject.....(a little long) I HOPE SUN DOES not COME AFTER ME....:-( To simply zero out the two files do the following: * In the Bourne or Korn shell: root@myhost$# > /var/adm/wtmp 2> /var/adm/wtmpx * In the C-shell, first make sure that noclobber is NOT set, then execute these two lines: root@myhost%# : cat > /var/adm/wtmp Ctrl-D root@myhost%# : cat > /var/adm/wtmpx Ctrl-D or, to avoid worrying about noclobber: root@myhost%# cp /dev/null /var/adm/wtmp root@myhost%# cp /dev/null /var/adm/wtmpx To shorten the files only partially, use the dd command with the skip and ibs arguments to tell dd how many records to skip, and how long each record is, respectively. The ibs argument should be set to 36 for wtmp, and 372 for wtmpx. Skip can be any number, but should be the same for both files. Note: The last command shows ABOUT half of the wtmpx entries in its output, as two entries are often on 1 line of the output, and some entries are not shown. The script below will automatically shorten the files, so there is no need to use dd directly. Note: Given an argument of 0, this script will also empty the file, if so desired. DISCLAMER: This script should be run at your own risk. This script is not supported by Sun Microsystems, Inc. ----- #!/bin/sh # # wtmp .truncate (/usr/adm/wtmp.truncate) - # truncate old records off of wtmp and wtmpx # # # This script was written by David Lindes, lindes@netcom.com # (c) Copyright 1994 by David Lindes. # # Permission to copy this script as wanted/needed is granted, # provided that it is distributed in its ENTIRETY, including # this copyright notice and disclaimer, all comments, and the # complete script. Modifications may be made to the default # values of the TMPDIR, WDIR, KEEP and FILES variables, but any # other modifications will be considered a violation of the # copyright agreement. # # No distribution of this script should be for any monetary or # compensatory charge without prior written consent of the # author. # # The default values given were written for the Solaris 2.3 # (SunOS 5.3) operating system, and should be verified before # use on any other operating system. # # NO GUARANTEE IS GRANTED AS TO THE BEHAVIOR OF THIS SCRIPT, AND # NO WARRANTY SHALL BE ISSUED, IMPLIEDOR OTHERWISE, BY THE AUTHOR, # BY SUN MICROSYSTEMS, OR BY ANY OTHER INDIVIDUAL OR COMPANY. # # USE THIS SCRIPT AT YOUR OWN RISK!!!! # # (Though comments for improvement are welcome at the above # e-mail address.) # Diagnostics: # Arguments: # optional - number of records to keep # or, if negative, to skip. # default: 60 ($KEEP) # # Exit codes: # 0 - Successful completion # 1 - No truncation needed with current $KEEP # 2 - Error from cp detected # 3 - Error from dd detected # # Notes: # This script will make a backup of your files in $TMPDIR # unless there is no truncation to be made, or there is an # error and it bails out. # Directory to store the temporary copies of the files: # (originally /tmp) TMPDIR=/tmp # Directory where the realfiles are stored: # (originally /var/adm) WDIR=/var/adm # List of files with record sizes, used for the for loop # (originally "wtmp:36 wtmpx:372") FILES="wtmp:36 wtmpx:372" # Number of records to keep if not modified by argument: # (originally 60, or $1 if argument given) KEEP=${1:-60} case "$KEEP" in -*) # set skip size for negative arguments SKIP=`echo $KEEP | cut -c2-` ;; +*) # accept explicit positives KEEP=`echo $KEEP | cut -c2-` unset SKIP ;; *) unset SKIP ;; esac # get the proper values, since $FILES is customizable. # these lines get the first entry in $FILES WTMPFILE=`echo $FILES | cut -d: -f1` WTMPSIZE=`echo $FILES | sed 's/^[^:]*:\([^ ]*\).*$/\1/'` FILESIZE=`ls -lL $WDIR/$WTMPFILE | awk '{print$5}'` # obtain thefilesize of w tmp # for later calculations NUMRECS=`expr $FILESIZE / $WTMPSIZE` # Store the size of the # utmp file, in records SKIP=${SKIP:-`expr $NUMRECS - $KEEP`} # number of records to skip, based on # $KEEP vs. number of records in the # wtmp file. if [ $SKIP -le 0 ] then exit 1 # nothing to truncate fi for PAIR in $FILES # Pair of filename and block size do FILE=`echo $PAIR | cut -d: -f1` # extract filename IBS=`echo $PAIR | cut -d: -f2` # extract record size cp $WDIR/$FILE $TMPDIR/$FILE # copy original to tmp STATUS=$? case $STATUS in 0) ;; *) echo "cp error #$STATUS, bailing out during $FILE." >&2 exit 2 ;; esac if [ $SKIP -ge $NUMRECS ] then > $WDIR/$FILE else dd if=$TMPDIR/$FILE of=$WDIR/$FILE ibs=$IBS skip=$SKIP 2> /dev/null # do the truncation fi STATUS=$? case $STATUS in 0) ;; *) echo "dd error#$STATUS, bailing out after $FILE." >&2 exit3 ;; esac done exit 0.