Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a VPS where I host some blogs /var/log/btmp file is fairly old - but is at 6.2 gigs.

I assume this means a lot of failed login attempts? Is this common over the course of a year ? Bots trying to get server access?

share|improve this question
You should accept some answers man. – Prof. Falken Nov 18 '11 at 12:08
up vote 1 down vote accepted

If you would like to rotate that log every month you can try add the below code to /etc/logrotate.conf

/var/log/btmp {
minsize 1M
create 0600 root utmp
rotate 1
share|improve this answer

I'm not familiar with the system which keeps it's ssh login info in that file (mine is in /var/log/authlog) but yes, automated attempts to log into ssh is a common part of what I consider the "background noise" of the internet. Often changing the port ssh listens on can cut this log clutter down considerably, though it's important not to confuse that with making your server more secure from a purposeful entry attempt.

share|improve this answer
+1 for cutting down on background noise, and pointing out that it is not Security through Obscurity – Josh Brower Sep 24 '09 at 20:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.