{"action":"created","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/8295","repository_url":"https://api.github.com/repos/systemd/systemd","labels_url":"https://api.github.com/repos/systemd/systemd/issues/8295/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/8295/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/8295/events","html_url":"https://github.com/systemd/systemd/issues/8295","id":300730551,"number":8295,"title":"/var/log/btmp grows without bound","user":{"login":"dkg","id":66738,"avatar_url":"https://avatars2.githubusercontent.com/u/66738?v=4","gravatar_id":"","url":"https://api.github.com/users/dkg","html_url":"https://github.com/dkg","followers_url":"https://api.github.com/users/dkg/followers","following_url":"https://api.github.com/users/dkg/following{/other_user}","gists_url":"https://api.github.com/users/dkg/gists{/gist_id}","starred_url":"https://api.github.com/users/dkg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dkg/subscriptions","organizations_url":"https://api.github.com/users/dkg/orgs","repos_url":"https://api.github.com/users/dkg/repos","events_url":"https://api.github.com/users/dkg/events{/privacy}","received_events_url":"https://api.github.com/users/dkg/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-27T17:50:28Z","updated_at":"2018-02-27T17:53:54Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"### Submission type\r\n\r\n - Bug report\r\n\r\n### systemd version the issue has been seen with\r\n\r\n237, 232-25+deb9u1 (debian stretch)\r\n\r\ni raised this on IRC at `#debian-systemd` and mbiebl suggested posting it upstream because [it's not just a debian issue](https://serverfault.com/questions/119299/my-var-log-btmp-file-is-huge-what-should-i-do).\r\n\r\n--------\r\n\r\nOn a clean system, `/var/log/btmp` is created with `/usr/lib/tmpfiles.d/var.conf` and it is updated (appended to) regularly by those daemons which can report bad logins (e.g. `sshd`).\r\n\r\nOn debian, if the `logrotate` package is installed, it rotates the file to `/var/log/btmp.1` on a monthly basis.  `/etc/logrotate.conf` has this stanza:\r\n\r\n```\r\n/var/log/btmp {\r\n    missingok\r\n    monthly\r\n    create 0660 root utmp\r\n    rotate 1\r\n}\r\n```\r\n\r\nHowever, logrotate has its own problems, such as by default restarting some daemons when it tries to rotate their log files.  This is an active hazard on systems with services that we want to have continuous uptime.  So i generally prefer to remove `logrotate` on clean systemd systems.\r\n\r\nHowever, this means that such a system that can be publicly probed (e.g. `sshd` listening on public port 22) will have `/var/log/btmp` grow without bound -- hundreds of MiB after a few months, depending on the frequency of the probes.\r\n\r\nIf systemd is going to ensure that `/var/log/btmp` is created (via `tmpfiles.d/var.conf`) it probably also needs to take responsibility for ensuring that it does not grow without bound.  This might be as simple as a `.timer` unit that rotates that file regularly, though it'd be nice to have it be more principled than that too.\r\n\r\nThis concern might also be relevant for `/var/log/wtmp`, though the problem is less severe there, given that authenticated, successful logins are typically fewer in number than malicious probes on the public network."},"comment":{"url":"https://api.github.com/repos/systemd/systemd/issues/comments/368967067","html_url":"https://github.com/systemd/systemd/issues/8295#issuecomment-368967067","issue_url":"https://api.github.com/repos/systemd/systemd/issues/8295","id":368967067,"user":{"login":"dkg","id":66738,"avatar_url":"https://avatars2.githubusercontent.com/u/66738?v=4","gravatar_id":"","url":"https://api.github.com/users/dkg","html_url":"https://github.com/dkg","followers_url":"https://api.github.com/users/dkg/followers","following_url":"https://api.github.com/users/dkg/following{/other_user}","gists_url":"https://api.github.com/users/dkg/gists{/gist_id}","starred_url":"https://api.github.com/users/dkg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dkg/subscriptions","organizations_url":"https://api.github.com/users/dkg/orgs","repos_url":"https://api.github.com/users/dkg/repos","events_url":"https://api.github.com/users/dkg/events{/privacy}","received_events_url":"https://api.github.com/users/dkg/received_events","type":"User","site_admin":false},"created_at":"2018-02-27T17:53:54Z","updated_at":"2018-02-27T17:53:54Z","author_association":"CONTRIBUTOR","body":"@mbiebl  points out that it would probably be bad if both logrotate and systemd tried to rotate `/var/log/btmp` -- so maybe any timer-driven rotation could have a `ConditionPathExists=!/etc/logrotate.conf` to avoid the collision."}}
{"actor":{"display_login":"dkg"}}