Home / server / Questions / 315009
Accepted
Luke
Asked: 2011-09-24 13:55:45 +0800 CST

/var/log/btmp is 6GB, how to trim it down?

  • 772

I know that /var/log/btmp is for failed login attempts. Typically having a file this large indicates brute force attempts. The 6GB is an accumulation over the past 3 years. I've taken steps to hide sshd so it is not accessible to anyone besides myself. These steps should drastically decrease the amount of log entires in this file.

The current entires up until this point is just noise - bots trying to brute force the server.

My question is, how do I safely empty this file, or trim it down to the last month? I know the format of this file isn't plain text, so I don't want to break the file (want to be able to review it later).

log-files security

2 Answers

  1. Best Answer

    Check the contents of the file with last -f /var/log/btmp. If you have a bot problem, try changing the default sshd port from 22 to something like 2222. You could also install DenyHosts as a way to temper the login attempts.

    Either way, you can safely truncate the file with : > /var/log/btmp.

    • 10

  2. I'd suggest using logrotate for it. There is an example config here: http://www.question-defense.com/2009/07/03/how-to-read-varlogbtmp-rotate-the-btmp-log-with-logrotate

    • 3