1

Every so often the last log is rotated out and stored in /var/log as wtmp* however when I look in my system in /var/log I only see the current wtmp file and the wtmp* file before it. I know the system has had more than one wtmp log rotation. Does the archived or rotated out wtmp log get overwritten each time it rotates? Does it get moved somewhere else? Did the system just fail to save the rotated-out file from the month before last?

To clarify my last wtmp rotation was OCT 1 and the one before that was SEPT 1. I have the log file from OCT 1 to today and I have the wtmp log file from SEPT1 to OCT1, but I cannot find the one that occurred before SEPT1.

Larmes
  • 13
  • 2

1 Answers1

1

On most Linux distributions logrotate only keeps one older version of /var/log/wtmp. If you need more, you can configure it typically in a place like /etc/logrotate.d/wtmp. Look for a line saying

rotate 1

and increase the value as needed.

Tilman Schmidt
  • 4,101
  • 12
  • 27