Ubuntu – Compression setting for log files in /var/log

log

For the log files in /var/log,
it appears that the wtmp and also the rotated wtmp.n are not ASCII file and can only be read by the last command, so if they are compressed, one has to first uncompress them and then use last -f ... to read. The other compressed log files can be easily read using an editor such as emacs since they are ASCII text files.

Is there a way to set "compress" for all other logs files except the wtmp.n?
(I assume that if one uncomments the #compress in the /etc/logrotate.conf, 

# uncomment this if you want your log files compressed
#compress

then all log files will be compressed, including the wtmp.)

Thanks

Best Answer

/var/log/wtmp is not a text file but it's not compressed either. It's a binary file and to decode it you need a dedicated tool called rawtmp available with the sac package.

sudo apt-get install sac

To access wtmp logs, type in a terminal:

rawtmp | less

Or to decode the first wtmp archive:

rawtmp -w /var/log/wtmp.1 | less

EDIT: To override logrotate compression settings for wtmp you just need to edit the /etc/logrotate.conf file:

sudo gedit /etc/logrotate.conf

To add the nocompress directive:

/var/log/wtmp {
    nocompress
    missingok
    monthly
    create 0664 root utmp
    rotate 12
}

From logrotate man page:

   nocompress
          Old versions of log files are not compressed. See also compress.
Related Question