UNIX for Dummies Questions & Answers

I don't exactly know what wtmpx file does in my system. I am quite skeptical whether I should trim this file or not because I don't know how to do that. Could you please reiterate further what does cp /dev/null /var/adm/wtmpx actually does? Thanks!

/var/adm/wtmpx contains the history of user access and adminstrative/accounting information for the utmpx database.
Yoiu can use 'last' command looks in the /var/adm/wtmpx file, which
records all logins and logouts, for information about a
user, a terminal, or any group of users and terminals.

( If accounting isn't enabled, clean up wtmp and wtmpx )
----------------------
You can refer to man pages for wtmpx and last.

cp /dev/null file
will leave you with an empty file. Empty the file or let system run out of disk space and crash. Whether you have accounting enabled on not, when was the last time you used wtmpx? The system doesn't need that data. It is saving it in case you want to see it. You have allowed the file to get too big to be useful. I have frequently copied /dev/null to /var/adm/wtmpx on solaris systems. It won't cause a system problem. If you let the system run out of space and crash, do you have the expertise to deal with that?

Besides you need to determine why it is growing so fast. It's too hard to do that while it's that large.

Sorry but I don't know how to check if the accounting is enabled or not. Could you please let me know? Before using the command cp /dev/null /var/adm/wtmpx, I still have to refer this matter to the customer support of the software that I am using right now whether this wtmpx file is being used by their software or not. This is just to confirm that our field operation won't be affected by such step. Moreover, I don't know if I am accessing wtmpx files or not and why is it growing that fast. For your info, I have temporarily stopped printing from my workstation until this problem is solved.

Thanks a lot for your help guys. I really appreciate it.

I ran the command “last -a -f /var/adm/wtmpx | more” to investigate what causes wtmpx file to grow fast and I found out that whenever we transfer a file via ftp from our workstation to pc and vice-versa, the size of this file increases at the same time. For your information, we do an ftp transfer every now and then to do a regular check to the file that is being generated during our field operation.

Could you please let me know how to disable the accounting in case we need to clean up the wtmpx file later on?

I am still waiting for the response from the Customer Support of the Software that we are using whether this wtmpx file is being utilized by their software to monitor any incongruities during our operation or not. I will let you know as soon as I get a reply from them. In the meantime, thanks a lot for all the help!

Accounting is a bunch of different things. They all write to /var and would have shown up when you did that find. Connect-time accounting is the only thing you have running. The only way to disable that is to remove wtmpx. That is legal and won't cause any system problems. But then you can't see who has been logging in to your system. So no one does that.

With most ftp servers, though, you can cause it to stop recording in wtmpx. If you are using Sun's ftpd, this is a -W option. You are probably running it from inetd, so you would edit /etc/inetd.conf and add the -W to the ftpd line. Then you need to "kill -1" inetd to make it reread the file. Read "man inetd" and "man ftpd".

You need to:
cp wtmpx wtmpx.old
cp /dev/null wtmpx
or something like that on a regular basis. Most people use a cron job.

Thanks once again for the info inetd and ftpd. While waiting for the response from our Software Customer Support, I'm still wondering that if ever I do a "cp /dev/null /var/adm/wtmpx", would it also increase the available disk space in my filesystem particularly /dev/dsk/c0t0d0s0 directory since wtmpx is on a different directory?