# wtmp+lastlog



## bernd (Nov 15, 2009)

heya. I'm curious as to whether you can symlink /var/log/wtmp + lastlog to /dev/null without issues. I understand that these files are no plaintext logs, which is basically the only issue that makes this question non-trivial since at least sshd tries to access these databases on a fairly regular basis. 

ps: i know what my proposed changes do and am willing to disable this kind of user activity logging.


----------



## lotuseclat79 (Sep 12, 2003)

Hi bernd,

Do you know all of the consequences of your suggested action? Why not go ahead and try it to see what happens? Yes, both files are data files:

The /var/log/wtmp is a file on Unix-like systems that keeps track of all logins and logouts to the system. It is defined in the Filesystem Hierarchy Standard 2.3.

lastlog formats and prints the contents of the last login log /var/log/lastlog file. The login-name, port, and last login time will be printed. The default (no flags) causes lastlog entries to be printed, sorted by their order in /etc/passwd

So, then, why do you think sshd accesses these files and why do you want to subvert the behavior that could potentially protect your system? It's not just activity logging for the sake of logging.

For example, if logins are not tracked - have you asked yourself what would be the consequences if you did not know whom was logged in?

Why do what you mention at all? Do you expect to gain a performance advantage? At what cost?

-- Tom


----------



## bernd (Nov 15, 2009)

its not a matter of performance, rather privacy and yes like i said, that'd completely disable w/who/last and whatnot.from my understanding the sshd accesses this DB whenvever a connection is established and closed. reason it does this is to provide the "Last login ... from ..." line you get after logon as well write the logout time to the DB when you close the connection. anyways - i didnt want to blindly test it out because i have no physical access to this box. which means if ssh-access gets disabled by this experiment i'd be locking myself out


----------

