I need a aix script to truncate wtmp to 90 days from today. Can't use logrotate not allowed.

I need a script to truncate the wtmp to 90 days. I can't use logrotate.
Anyone have something similar out there?
LVL 1
craig FennengineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

woolmilkporcCommented:
Hi,

I have a script to truncate the wtmp file to a certain number of lines (5000 in the example below):

LINES=5000
/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp.full
tail -n $LINES /tmp/wtmp.full > /tmp/wtmp.short
/usr/sbin/acct/fwtmp -ic < /tmp/wtmp.short > /var/adm/wtmp
rm -f /tmp/wtmp.full /tmp/wtmp.short

Truncating by days would require much more effort. Do you really need it?
0
craig FennengineerAuthor Commented:
I do.
I have something similar to that as well but this is a specific request.
0
woolmilkporcCommented:
With

/usr/sbin/acct/fwtmp  < /var/adm/wtmp

do you see the last columns in this format:

 Mon Nov 10 18:26:38 Timezone 2014

i.e. exactly 6 fields from "day of week" to "year"? If you don't please post some sample lines!

(I don't need that date for calculations, I just need a criterion to distinguish between logon and logoff records!)
0
Cloud Class® Course: Python 3 Fundamentals

This course will teach participants about installing and configuring Python, syntax, importing, statements, types, strings, booleans, files, lists, tuples, comprehensions, functions, and classes.

woolmilkporcCommented:
If the format of the last columns (date/time in readable format) is as specified above try this:

DAYS=90 # Number of days to be kept
NOW=$(date "+%s")
SECS=$((DAYS*86400))
CUT=$((NOW-SECS))
/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp.full
awk -v cut=$CUT '!/openacct/ {check=$7; if(NF>13) check=$8; if(check>cut) print}' /tmp/wtmp.full > /tmp/wtmp.short
/usr/sbin/acct/fwtmp -ic < /tmp/wtmp.short > /var/adm/wtmp
rm -f /tmp/wtmp.full /tmp/wtmp.short
0
craig FennengineerAuthor Commented:
This is what it looks like.
orastart orastart                     5 426196 0000 0000 1324297901                                  Mon Dec 19 07:31:41 EST 2011
         orastart                           8 426196 0000 0000 1324297963                                  Mon Dec 19 07:32:43 EST 2011
         ctrmc                               8 401604 0000 0000 1324297963                                  Mon Dec 19 07:32:43 EST 2011
orastart orastart                     5 889028 0000 0000 1324297963                                  Mon Dec 19 07:32:43 EST 2011
         orastart                           8 889028 0000 0001 1324297964                                  Mon Dec 19 07:32:44 EST 2011
startlaw startlaw                     5 889030 0000 0000 1324297964                                  Mon Dec 19 07:32:44 EST 2011
0
woolmilkporcCommented:
Do you really have a username in the first column of each line?

Obfuscatiing host or IP is of course OK, but removing it entirely is heavily misleading. I hope you didn't do that.
0
woolmilkporcCommented:
Your posted output format given this is a clean solution:
#!/bin/ksh
DAYS=90 # Number of days to be kept
NOW=$(date "+%s")
SECS=$((DAYS*86400))
CUT=$((NOW-SECS))
/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp.full
awk -v cut=$CUT '!/openacct/ {check=$(NF-6); if(check~"[a-zA-Z.]") check=$(NF-7); if(check>cut) print}' /tmp/wtmp.full >/tmp/wtmp.short
/usr/sbin/acct/fwtmp -ic < /tmp/wtmp.short > /var/adm/wtmp
rm -f /tmp/wtmp.full /tmp/wtmp.short

Open in new window

0
craig FennengineerAuthor Commented:
I received the following error:
 

Syntax Error The source line is 1.
 The error context is
                !/openacct/ {check=$(NF-6); >>>  if($(NF-6)~[ <<<
 awk: 0602-502 The statement cannot be correctly parsed. The source line is 1.
0
woolmilkporcCommented:
Somehow the double quotes around the regex must have been lost (?) The awk command should read:

awk -v cut=$CUT '!/openacct/ {check=$(NF-6); if($(NF-6)~"[a-zA-Z.]") check=$(NF-7); if(check>cut) print}' /tmp/wtmp.full >/tmp/wtmp.short
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
craig FennengineerAuthor Commented:
Worked Great!
Thanks so much!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Unix OS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.