By booghaw
we have a solaris 10 box that was handled by a different sysadmin before & now it is turned over to us for system administration. our concern is that if we issue the “last” command, it usually says “wtmp begins current day current month date 02:30″. just like this “wtmp begins Thu Mar 7 02:30”
we suspect that there is a cronjob that runs & deletes the wtmpx file. when i run the crontab -l (as root) command, there is no job that is scheduled on 2:30am. what we would like is to retain the wtmpx file at least for 1 week so that we can have a historical log of users then we will just manually delete/rotate wtmpx.
can you help me figure out which in my crontab entry is doing the deletion of the wtmpx. here’s what is in the crontab file:
#ident "@(#)root 1.21 04/03/23 SMI"
#
# The root crontab should be used to perform accounting data collection.
#
#
10 3 * * * /usr/sbin/logadm
15 3 * * 0 /usr/lib/fs/nfs/nfsfind
30 3 * * * [ -x /usr/lib/gss/gsscred_clean ] && /usr/lib/gss/gsscred_clean
#10 3 * * * /usr/lib/krb5/kprop_script ___slave_kdcs___
00 06 * * * /usr/bin/metacheck.ksh
0 2 * * 4 /usr/lib/acct/dodisk
logadm uses the /etc/logadm.conf file & here is what is inside logadm.conf:
/var/log/syslog -C 8 -P 'Sun Mar 3 19:10:00 2013' -a 'kill -HUP `cat /var/run/syslog.pid`'
/var/adm/messages -C 4 -P 'Sun Mar 3 19:10:00 2013' -a 'kill -HUP `cat /var/run/syslog.pid`'
/var/cron/log -P 'Wed Mar 6 19:10:00 2013' -c -s 10240k -t /var/cron/olog
/var/lp/logs/lpsched -C 2 -N -P 'Tue Mar 5 19:10:00 2013' -t '$file.$N'
/var/fm/fmd/errlog -M '/usr/sbin/fmadm -q rotate errlog && mv /var/fm/fmd/errlog.0- $nfile' -N -s 2m
/var/fm/fmd/fltlog -A 6m -M '/usr/sbin/fmadm -q rotate fltlog && mv /var/fm/fmd/fltlog.0- $nfile' -N -s 10m
smf_logs -C 8 -s 1m /var/svc/log/*.log
#
# The entry below is used by turnacct(1M)
#
/var/adm/pacct -C 0 -N -P 'Thu Mar 7 03:00:00 2013' -a '/usr/lib/acct/accton pacct' -g adm -m 664 -o adm -p never
#
# The entry below manages the Dynamic Resource Pools daemon (poold(1M)) logfile.
#
/var/log/pool/poold -N -a 'pkill -HUP poold; true' -s 512k
/var/svc/log/application-management-sunmcagent:default.log -P 'Wed Mar 6 19:10:00 2013'
thanks.
…read more
Source: FULL ARTICLE at The UNIX and Linux Forums