Re: logrotate wtmp,btmp,lastlog
In article <[🔎] 20010918170547.B2202@doorstop.net>,
Vineet Kumar <debian-user@virtual.doorstop.net> wrote:
>I noticed that the stock /etc/logrotate.conf includes explicit
>configurations for wtmp and btmp after this comment:
>
># no packages own wtmp, or btmp -- we'll rotate them here
>
>Until recently, this file included a rotator for lastlog as well, and it
>also had mention in the comment.
.. and that was a bug, since lastlog should not ever be rotated.
>I'm not sure I agree with that comment, though:
>
>vineet@gobo ~ % dpkg -L login | grep lastlog
>/usr/bin/lastlog
>/usr/share/man/man8/lastlog.8.gz
That's a tool that reads the lastlog file, but several programs
write to it (login and sshd currently I guess)
>vineet@gobo ~ % dpkg -L sysvinit | grep last
>/usr/share/man/man1/last.1.gz
>/usr/share/man/man1/lastb.1.gz
>/usr/bin/last
>/usr/bin/lastb
Ditto, those are tools to read those files, but several programs
create and update those files (init, login, sshd, telnetd, ftpd, etc)
>shouldn't the log files, then, be rotated from /etc/logrotate.d/login
>and /etc/logrotate.d/sysvinit, respectively?
.. or sshd or telnetd or ftpd or login or ....
>Also (I take that I have this next question as evidence that I'm not
>altogether sure what's going on in this whole situation and thus don't
>feel instilled with the authority to file a bug report) what happened to
>lastlog's mention? Where is its logrotate instructions? I see that mine
>was rotated at the beginning of this month, although it's not mentioned
>in my logrotate.conf .Now that I think about it, what's rotating all of
>those logfiles in my /var/log ? I don't see any mention for any of them
>in any of my /etc/logrotate.{d/*,conf} .
This is a FAQ and alas also a recurring bug .. lastlog should NOT
EVER be rotated. It's a database in the form of a Unix sparse file
that doesn't grow. Though "ls" says it's size is several megabytes
it only takes a few physical KBs on disk.
Mike.
--
"I think...I think it's in my basement. Let me go upstairs and check."
-- M.C. Escher (1898-1972)
Reply to: