Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a VPS where I host some blogs /var/log/btmp file is fairly old - but is at 6.2 gigs.

I assume this means a lot of failed login attempts? Is this common over the course of a year ? Bots trying to get server access?

share|improve this question
1  
You should accept some answers man. –  Prof. Falken Nov 18 '11 at 12:08
add comment

2 Answers

up vote 1 down vote accepted

If you would like to rotate that log every month you can try add the below code to /etc/logrotate.conf

/var/log/btmp {
monthly
minsize 1M
create 0600 root utmp
rotate 1
}
share|improve this answer
add comment

I'm not familiar with the system which keeps it's ssh login info in that file (mine is in /var/log/authlog) but yes, automated attempts to log into ssh is a common part of what I consider the "background noise" of the internet. Often changing the port ssh listens on can cut this log clutter down considerably, though it's important not to confuse that with making your server more secure from a purposeful entry attempt.

share|improve this answer
    
+1 for cutting down on background noise, and pointing out that it is not Security through Obscurity –  Josh Brower Sep 24 '09 at 20:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.