Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My /var/log/btmp file is 1.3 GB in size. I've read that the file is "Used to store information about failed login".

What does this mean for my server? And can i delete this file?

share|improve this question
up vote 49 down vote accepted

This means people are trying to brute-force your passwords (common on any public-facing server).

It shouldn't cause any harm to clear out this file.

One way to reduce this is to change the port for SSH from 22 to something arbitrary. For some additional security, DenyHosts can block login attempts after a certain number of failures. I'd highly recommend installing and configuring it.

share|improve this answer
Nice to know. Thanks!!! Brute force this -- 6rRr3Pamo.*DD.(ao)p72EC2H – zmonteca Nov 7 '14 at 20:40

fail2ban can also be a great help for machines that must keep internet facing, port 22 SSH. It can be configured to use hosts.allow or iptables with flexible thresholds.

share|improve this answer

You could also examine the file with the lastb command and determine the IP number and maybe block the IP number or network from further accessing your machine. This will also provide information as to the account being hacked. Most likely it will be root but you never know

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.