Forum Discussion
Michael_61068
Altocumulus
AltocumulusLarge number of entries in WTMP file
Hi,
I have been exploring a lack of disk space in the /var/log/filesystem.
The biggest offender is the WTMP file. When look into the file using utmpdump I can see the login entries.
I can see my connection as "root" to the device, but I also see there are entries every 10s even when no one is connected?
Is this normal behaviour as it appears to be filling up the log file and taking disk space for not reason.
The particular device is a virtual appliance running 12.1.2.
Many thanks,
Michael
[6] [24081] [v/tt] [LOGIN ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:16:39 2017 ]
[8] [24081] [v/tt] [ ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:16:49 2017 ]
[8] [24082] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:16:49 2017 ]
[8] [24083] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:16:49 2017 ]
[6] [24084] [v/tt] [LOGIN ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:16:49 2017 ]
[8] [24084] [v/tt] [ ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:16:59 2017 ]
[8] [24085] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:16:59 2017 ]
[8] [24086] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:16:59 2017 ]
[6] [24087] [v/tt] [LOGIN ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:16:59 2017 ]
[8] [24087] [v/tt] [ ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:09 2017 ]
[8] [24092] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:09 2017 ]
[8] [24093] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:09 2017 ]
[6] [24095] [v/tt] [LOGIN ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:09 2017 ]
[8] [24095] [v/tt] [ ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:19 2017 ]
[8] [24101] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:19 2017 ]
[8] [24102] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:19 2017 ]
[6] [24103] [v/tt] [LOGIN ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:19 2017 ]
[7] [24106] [ts/0] [root ] [pts/0 ] [172.17.1.177 ] [172.17.1.177 ] [Wed Oct 11 09:17:19 2017 ]
[8] [24103] [v/tt] [ ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:29 2017 ]
[8] [24132] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:29 2017 ]
[8] [24133] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:29 2017 ]
[6] [24134] [v/tt] [LOGIN ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:29 2017 ]
[8] [24134] [v/tt] [ ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:39 2017 ]
[8] [24136] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:39 2017 ]
[8] [24137] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:39 2017 ]
[6] [24138] [v/tt] [LOGIN ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:39 2017 ]
[8] [24138] [v/tt] [ ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:49 2017 ]
[8] [24301] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:49 2017 ]
[8] [24310] [v/tt] [ ] [ ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:49 2017 ]
[6] [24314] [v/tt] [LOGIN ] [/dev/ttyS0 ] [ ] [0.0.0.0 ] [Wed Oct 11 09:17:49 2017 ]
Leonardo_SouzaCirrocumulus
As you already know, that files registers the login in the system. It is possible to have entries that are automatically generated by the system, in case of a reboot for example. However, is not normal that you have so many logins that is causing disk space issues.
You can use the last command to see those entries as well:
https://linux.die.net/man/1/last
If you can't figure out why the logins, better open a ticket with F5 support.