last: btmp: File too large, Read Large btmp Files

Earlier today while investigating the logs on a CentOS Linux server I noticed the btmp file had grown to over 5GB. I was curious to look into the log and when attempting to read the 5GB file using last I received an error since last will only handle files that are 2GB in size or less. So what needs to happen is to split the file into multiple pieces so they can be read via the last command. Below I describe the error in detail, how to resolve it by splitting the btmp file into multiple files, and then how to join them together if you need to read logs older than the last split file.

Large btmp File Not Read By last Command On Linux:

Use ls To View Size Of btmp File On CentOS Linux:

Split btmp File Into Multiple Files To Read Using last:

1. Install lxsplit: Install lxsplit using the EPEL repository on CentOS Linux. If the EPEL repo is not installed you can install it using the instructions located here. If you are using another distribution a quick Google search should return information on how to install lxsplit after which you can continue to the next step. On CentOS Linux the lxsplit via yum will look similar to the below.
   bash

   
   

   1. [root@dev log]# yum install lxsplit
   2. Loaded plugins: fastestmirror
   3. Loading mirror speeds from cached hostfile
   4.  * addons: dist1.800hosting.com
   5.  * atomic: www4.atomicorp.com
   6.  * base: mirror.san.fastserv.com
   7.  * epel: mirrors.tummy.com
   8.  * extras: mirrors.tummy.com
   9.  * rpmforge: ftp-stud.fht-esslingen.de
   10.  * updates: mirror.raystedman.net
   11. Setting up Install Process
   12. Resolving Dependencies
   13. --> Running transaction check
   14. ---> Package lxsplit.i386 0:0.2.2-4.el5 set to be updated
   15. --> Finished Dependency Resolution
   16.  
   17. Dependencies Resolved
   18.  
   19. ====================================================================================================================================
   20.  Package                        Arch                        Version                               Repository                   Size
   21. ====================================================================================================================================
   22. Installing:
   23.  lxsplit                        i386                        0.2.2-4.el5                           epel                         17 k
   24.  
   25. Transaction Summary
   26. ====================================================================================================================================
   27. Install       1 Package(s)
   28. Upgrade       0 Package(s)
   29.  
   30. Total download size: 17 k
   31. Is this ok [y/N]: y
   32. Downloading Packages:
   33. lxsplit-0.2.2-4.el5.i386.rpm                                                                                 |  17 kB     00:00
   34. Running rpm_check_debug
   35. Running Transaction Test
   36. Finished Transaction Test
   37. Transaction Test Succeeded
   38. Running Transaction
   39.   Installing     : lxsplit                                                                                                      1/1
   40.  
   41. Installed:
   42.   lxsplit.i386 0:0.2.2-4.el5
   43.  
   44. Complete!
   45. [root@dev log]#
2. Determine btmp Split Size: Based on the size of your btmp file you may want to split it into smaller or larger files using lxsplit. I recommend viewing lxsplit –help as displayed below to show you how lxsplit works and based on the amount of history from the btmp log that you need to read determine the size to split the file into.
   bash

   
   

   1. [root@dev log]# lxsplit --help
   2. LXSplit v0.2.2 by Richard Stellingwerff.
   3.  
   4. Usage: lxsplit [OPTION] [FILE] [SPLITSIZE]
   5.  
   6. Available options:
   7.  -j : join the files beginning with the given name
   8.  -s : split the given file.  requires a valid size
   9. Splitsize examples: 15M, 100m, 5000k, 30000000b
   10.  
   11. Examples:
   12.         lxsplit -s hugefile.bin 15M
   13.         lxsplit -j hugefile.bin.001
   14.  
   15. [root@dev log]#
3. Split btmp Log File: Now issue an lxsplit command similar to the below example to split the btmp log file down.
   bash

   
   

   1. [root@dev log]# lxsplit -s btmp 500M
   2. Splitting btmp into 11 pieces.
   3. btmp.001                        524288000 bytes
   4. btmp.002                        524288000 bytes
   5. btmp.003                        524288000 bytes
   6. btmp.004                        524288000 bytes
   7. btmp.005                        524288000 bytes
   8. btmp.006                        524288000 bytes
   9. btmp.007                        524288000 bytes
   10. btmp.008                        524288000 bytes
   11. btmp.009                        524288000 bytes
   12. btmp.010                        524288000 bytes
   13. btmp.011                        80595328 bytes
   14. Done!
   15. [root@dev log]#
4. Read New btmp Files With Last: You can immediately read the last btmp file that was split using lxsplit but you will need to join the last file and any of the other btmp chunks that you want read before you can read those files. Below we show examples of reading just the last btmp file which in this example is btmp.011 and by combining the last btmp split file with another btmp split file to read that as well.

   Read Last btmp Split File:

   bash

   
   

   1. [root@dev btmp-tests]# last -f btmp.011 | more
   2. root     ssh:notty    61.145.61.108    Mon Jan 17 09:02    gone - no logout
   3. root     ssh:notty    61.145.61.108    Mon Jan 17 09:01 - 09:02  (00:00)
   4. root     ssh:notty    61.145.61.108    Mon Jan 17 09:01 - 09:01  (00:00)
   5. root     ssh:notty    61.145.61.108    Mon Jan 17 09:01 - 09:01  (00:00)

   Join Last btmp Split File And Another btmp Split File:

   bash

   
   

   1. [root@dev btmp-tests]# cp -p btmp.001 btmp.a.001
   2. [root@dev btmp-tests]# cp -p btmp.011 btmp.a.002
   3. [root@dev btmp-tests]# lxsplit -j btmp.a.001
   4. Creating merged file `btmp.a'.
   5. Complete size: 604883328 in 2 files.
   6. Processing file `btmp.a.001' ...
   7. Processing file `btmp.a.002' ...
   8. Done!
   9. [root@dev btmp-tests]#

   Notice how in the above example output that we combine the last and the first btmp file chunks and once this is completed you can read the output using last which will include the newest and the oldest btmp log file entries. You cannot read the btmp.001 file without combining it with the btmp.011 file created by lxsplit.

After reviewing the btmp file output that is necessary you should also configure logrotate to include the btmp file by reading this article on the subject.