how to logrotate /var/log/btmp?

[RedBullet]

So, I got /var/tmp/btmp filling up on one of my NASes (running latest OS6). I know why (so don't start off by telling me something bad is happening, I have fixed that)./

What was concerning was that the file was allowed to grow (apparently) without bound on my limited root file system. I added an entry to rotatelogs.d but couldn't even tell if that was the proper mechanism.

Here is what I created:

/var/log/btmp {
monthly
size 100M
create 0600 root utmp
rotate 2
}

[mdgm-ntgr]

So you are running 6.4.1?

[RedBullet]

Yep!

[mdgm-ntgr]

I have seen a system where this log file has grown to a huge size before and have passed on that you have encountered this as well.

[RedBullet]

Yea, I know why it grew that much; I've since changed the portforwarding for the ssh port I was using.

But my question was more about how to rotate the log so my system root doesn't fill up again. I was lucky I caught it and stopped if before the root filled up. Is logrotate used in os6? I see some evidence, but didn't see a service running or a crontab entry for it.

[mdgm-ntgr]

We do automatically rotate a number of logs (not sure if /var/log/btmp is one of those), but if logs are flooded at an extremely high rate it is possible that the OS partition could fill before the next scheduled check to see what needs to be rotated takes place.

[RedBullet]

there wasn't an logrotate file for btmp which is why I created one. I just don't know if that is sufficient.

How are log rotated? I assume that logrotate is used since there is an /etc/logrotate.d but I didn't see a service running or a crontab entry.

Am I missing something? 

I know the file was not filling at an extremey high rate. 

[mdgm-ntgr]

I think there are a few different different things we do. Some may simply be pruned and others are rotated.

We will have a fix for this issue in future firmware, where we will store a compressed backup of btmp and empty the file if it is getting large.

[RedBullet]

Thanks! I can take care of it in the short term.

[RedBullet]

Extra credit would be to expose something like logrotate so that users can use the mechanism for their own logs...

[StephenB]

---

@RedBullet wrote:

Extra credit would be to expose something like logrotate so that users can use the mechanism for their own logs...

---

I suggest posting thi in the idea exchange