2

For the log files in /var/log,
it appears that the wtmp and also the rotated wtmp.n are not ASCII file and can only be read by the last command, so if they are compressed, one has to first uncompress them and then use last -f ... to read. The other compressed log files can be easily read using an editor such as emacs since they are ASCII text files.

Is there a way to set "compress" for all other logs files except the wtmp.n?
(I assume that if one uncomments the #compress in the /etc/logrotate.conf,

# uncomment this if you want your log files compressed
#compress

then all log files will be compressed, including the wtmp.)

Thanks

1 Answer 1

3

/var/log/wtmp is not a text file but it's not compressed either. It's a binary file and to decode it you need a dedicated tool called rawtmp available with the sac package.

sudo apt-get install sac

To access wtmp logs, type in a terminal:

rawtmp | less

Or to decode the first wtmp archive:

rawtmp -w /var/log/wtmp.1 | less

EDIT: To override logrotate compression settings for wtmp you just need to edit the /etc/logrotate.conf file:

sudo gedit /etc/logrotate.conf

To add the nocompress directive:

/var/log/wtmp {
    nocompress
    missingok
    monthly
    create 0664 root utmp
    rotate 12
}

From logrotate man page:

   nocompress
          Old versions of log files are not compressed. See also compress.
4
  • Thanks for informing the sac tool. Yeah I should write wtmp.x (the rotated older wtmp files) are compressed, you are right wtmp itself is not compressed otherwise "last" would show unreadable chars. It surprised me a bit that the #compress in my /etc/logrotate.conf is not uncommented, but all my older rotated log files got compressed, which made me wonder which default setting takes precedence over the settings in /etc/logrote.conf. Apr 7, 2014 at 23:09
  • to read uncompressed wtmp.1, you don't need a specific tool such as sac, the plain "last -f /var/log/wtmp.1" command works fine. but if the wtmp.1 file is automatically compressed into wtmp.1.gz (as appeared in my computer), then I need an extra step to uncompress it. Do you happen to know a way to let the compute not to compress any wtmp.x files automatically? (note that reading a binary file wtmp.1 was not a problem even without sac. thanks) Apr 8, 2014 at 20:41
  • I've updated my answer Apr 9, 2014 at 9:45
  • just see your reply. your cool answer is now labelled as accepted, thanks much! Apr 17, 2014 at 0:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .