Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!uunet!samsung!usc!snorkelwacker!mit-eddie!aryeh
From: aryeh@eddie.mit.edu (Aryeh M. Weiss)
Newsgroups: comp.unix.xenix
Subject: Re: Why is wtmp so big?
Message-ID: <1989Dec6.140427.3304@eddie.mit.edu>
Date: 6 Dec 89 14:04:27 GMT
References: <1226@ispi.UUCP> <413@tabbs.UUCP>
Reply-To: eliot@lees-rif.mit.edu (Eliot Frank)
Organization: MIT EE/CS Computer Facilities, Cambridge, MA
Lines: 33

In article <413@tabbs.UUCP> aris@tabbs.UUCP (Aris Stathakis) writes:
> ...
>
>Is there perhaps any program out there ther truncates the /etc/wtmp
>file to the 100 most recent entries?  
>
>Since it is a binary file, this is no trivial task.
               ^^^^^^
>
>Thanks in advance.
>
>Aris
>
>-- 
>Aris Stathakis | Bang: ..!uunet!ddsw1!olsa99!tabbs!aris or aris@tabbs.UUCP
>         - Gimme a beer and money sandwich....  Hold the bread -
>                                                  - Waldo (D.R.) Dobbs

Since it IS a binary file, it IS a trivial task -- all records in the
file are the same size.  I don't know the record size off hand, but you could
use something like "dd":

if file is big then
	dd if=/etc/wtmp of=/tmp/wtmp bs=<record-size> \
	    skip=<(file-size/record-size) - 100> count=100
	mv /tmp/wtmp /etc/wtmp
endif

Of course you need to know the record-size and file-size but these can be 
figured out by suitable means.

-- 
eliot%lees-rif@eddie.mit.edu (Eliot H. Frank)