Take the 2-minute tour ×

On a VPS where I host some blogs /var/log/btmp file is fairly old - but is at 6.2 gigs.

I assume this means a lot of failed login attempts? Is this common over the course of a year ? Bots trying to get server access?

share|improve this question
You should accept some answers man. –  Prof. Falken Nov 18 '11 at 12:08

2 Answers 2

up vote 1 down vote accepted

If you would like to rotate that log every month you can try add the below code to /etc/logrotate.conf

/var/log/btmp {
minsize 1M
create 0600 root utmp
rotate 1
share|improve this answer

I'm not familiar with the system which keeps it's ssh login info in that file (mine is in /var/log/authlog) but yes, automated attempts to log into ssh is a common part of what I consider the "background noise" of the internet. Often changing the port ssh listens on can cut this log clutter down considerably, though it's important not to confuse that with making your server more secure from a purposeful entry attempt.

share|improve this answer
+1 for cutting down on background noise, and pointing out that it is not Security through Obscurity –  Josh Brower Sep 24 '09 at 20:21

Your Answer


