My /var/log/btmp file is 1.3 GB in size. I've read that the file is "Used to store information about failed login".
What does this mean for my server? And can I delete this file?
Centos – My /var/log/btmp file is huge! How to do
centoslog-files
Related Topic
- Nginx error log was huge, so I deleted and created a new one, now nginx won’t start
- Ubuntu – /var/log/btmp not readable format
- Linux – what service to restart for /var/log/auth.log to start
- Linux – “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean
- Security – /var/log/btmp is 6GB, how to trim it down
- Linux – PubKey Authentication not Working
Best Answer
This means people are trying to brute-force your passwords (common on any public-facing server).
It shouldn't cause any harm to clear out this file.
One way to reduce this is to change the port for SSH from 22 to something arbitrary. For some additional security, DenyHosts can block login attempts after a certain number of failures. I'd highly recommend installing and configuring it.