Path: utzoo!utgpu!jarvis.csri.toronto.edu!clyde.concordia.ca!uunet!tut.cis.ohio-state.edu!purdue!ames!sgi!vjs@rhyolite.wpd.sgi.com
From: vjs@rhyolite.wpd.sgi.com (Vernon Schryver)
Newsgroups: comp.sys.sgi
Subject: Re: WARNING 3.2.1 may remove your accounting data
Message-ID: <47178@sgi.sgi.com>
Date: 29 Dec 89 03:44:29 GMT
References: <1009@sdrc.UUCP>
Sender: vjs@rhyolite.wpd.sgi.com
Organization: Silicon Graphics, Inc., Mountain View, CA
Lines: 28


/etc/wtmp is rotated to prevent unhappy consequences of infinite growth.
The general scheme is ancient, having been copied from 2000/3000 days.

The next release has a slightly handier scheme, where wtmp is rotated only
if it is "big".  This is handy for the common case, where the "last"
command is the only thing that looks at wtmp and the machine is used by few
people so wtmp grows slowly.  The last command will also have facilities to
suppress some of the extraneous lines, and to specify an alternate file,
such as /etc/OLDwtmp.

An accounting scheme which relies on wtmp and last seems novel.  However,
one should not argue with success.  Such a system would no doubt want to do
its own wtmp rotating, by modifying /usr/spool/cron/crontabs/root.
With each new release, you might want to consider merging your changes
with ours.

Anyone with such a system should beware that not only do we not promise to
not change either output of the last command or the structure of utmp and
wtmp, but we intend to change both in the release after next.  This is part
of a grand plan to get 4.3 BSD style host names into wtmp.  Do not be
surprised to see a "shadow wtmp" in the next release, used by the last
and w commands to produce new-style output.


Vernon Schryver
Silicon Graphics
vjs@sgi.com