Bug 259281 - logrotates default config rotates wtmp irrationally often
Summary: logrotates default config rotates wtmp irrationally often
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: logrotate   
(Show other bugs)
Version: 5.0
Hardware: All
OS: All
Target Milestone: ---
: ---
Assignee: Tomas Smetana
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2007-08-28 08:28 UTC by ilja lunev
Modified: 2013-04-12 19:19 UTC (History)
1 user (show)

Fixed In Version: RHBA-2007-1002
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-11-15 14:07:47 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2007:1002 normal SHIPPED_LIVE logrotate bug fix update 2007-11-15 14:07:38 UTC

Description ilja lunev 2007-08-28 08:28:35 UTC
Description of problem:
The default config for logrotate contains the following specification for wtmp

/var/log/wtmp {
    create 0664 root utmp
    rotate 1

wtmp is the source to "last" which gives valuable login information.
Many systems show only few entries thus it seems more reasonable to me to rotate
wtmp depending on its size than on a fixed time schedule.
A fixed time schedule can too easily loose valuable history information
especially in an enterprise environment.
I suggest to change the default from "monthly" to "size=1M" which I rate a good
balance between log size and history information.

Comment 1 Tomas Smetana 2007-08-28 08:46:52 UTC
This could lead to an endless discussion...  Personally I think it's better to
know that I always have two months history login records than a particular size
of a log file (that also may not fit everyone).  Let the PM decide.

Comment 2 ilja lunev 2007-08-29 06:48:44 UTC
If the PM decides to leave it like it is that's OK to me.
I can always make my own settings of course.
My statement is just derived from real world scenarios where I support app. 200
Linux and HPUX hosts and most of them have only about 30 entries in wtmp. Thus
there is valuable history information lost when the log holds only 2 months of
With RH5 there is the option minsize which only rotates at a given time
specification when the log is larger than minsize.
So it may be a good compromise to specify
 /var/log/wtmp {
    minsize 1M
    create 0664 root utmp
    rotate 1

Comment 3 Tomas Smetana 2007-08-29 07:06:55 UTC
Yes, minsize looks to be a good solution.

Comment 10 errata-xmlrpc 2007-11-15 14:07:47 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.