Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that /var/log/btmp is for failed login attempts. Typically having a file this large indicates brute force attempts. The 6GB is an accumulation over the past 3 years. I've taken steps to hide sshd so it is not accessible to anyone besides myself. These steps should drastically decrease the amount of log entires in this file.

The current entires up until this point is just noise - bots trying to brute force the server.

My question is, how do I safely empty this file, or trim it down to the last month? I know the format of this file isn't plain text, so I don't want to break the file (want to be able to review it later).

share|improve this question
up vote 6 down vote accepted

Check the contents of the file with last -f /var/log/btmp. If you have a bot problem, try changing the default sshd port from 22 to something like 2222. You could also install DenyHosts as a way to temper the login attempts.

Either way, you can safely truncate the file with : > /var/log/btmp.

share|improve this answer
+1 for denyhosts – Danny Staple Sep 23 '11 at 22:03
I've actually taken steps to protect port 22, among other things. Just wanted to make sure emptying the file wouldn't break anything :). Thanks. – Luke Sep 23 '11 at 22:13

I'd suggest using logrotate for it. There is an example config here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.