Re: [SLUG] wtmp Filling with connections

From: Kwan Lowe (kwan@digitalhermit.com)
Date: Sat May 07 2005 - 13:29:48 EDT


Mike Branda wrote:

>>/sbin/agetty 38400 tty1 linux
>>/sbin/agetty 38400 tty2 linux
>>/sbin/agetty 38400 tty3 linux
>>/sbin/agetty 38400 tty4 linux
>>/sbin/agetty 38400 tty5 linux
>>/sbin/agetty 38400 tty6 linux
>>
>>They are running rampant...
>
> Hmmm....still searching...some people seem to suggest using
> logrotate/cron to automate the removal and replacement of the wtmp.
> Don't know how good that is since wtmp seems to not be plain ascii but
> it might be a good temporary fix to stop the disk from filling to
> capacity. That would buy more time to research what is causing the
> problem (see man logrotate). I'll keep looking.
>

Since it's a serial connection, one possibility may be a bad duplex or
baud setting causing garbage on the line leading to lots of failed login
attempts. You can also move the file elsewhere then run 'last' against
it to see what's happening.
-----------------------------------------------------------------------
This list is provided as an unmoderated internet service by Networked
Knowledge Systems (NKS). Views and opinions expressed in messages
posted are those of the author and do not necessarily reflect the
official policy or position of NKS or any of its employees.



This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 18:42:23 EDT