Description of problem: The default config for logrotate contains the following specification for wtmp /var/log/wtmp { monthly create 0664 root utmp rotate 1 wtmp is the source to "last" which gives valuable login information. Many systems show only few entries thus it seems more reasonable to me to rotate wtmp depending on its size than on a fixed time schedule. A fixed time schedule can too easily loose valuable history information especially in an enterprise environment. I suggest to change the default from "monthly" to "size=1M" which I rate a good balance between log size and history information.
This could lead to an endless discussion... Personally I think it's better to know that I always have two months history login records than a particular size of a log file (that also may not fit everyone). Let the PM decide.
If the PM decides to leave it like it is that's OK to me. I can always make my own settings of course. My statement is just derived from real world scenarios where I support app. 200 Linux and HPUX hosts and most of them have only about 30 entries in wtmp. Thus there is valuable history information lost when the log holds only 2 months of data. With RH5 there is the option minsize which only rotates at a given time specification when the log is larger than minsize. So it may be a good compromise to specify /var/log/wtmp { monthly minsize 1M create 0664 root utmp rotate 1 }
Yes, minsize looks to be a good solution.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2007-1002.html