pam_lastlog is complaining about corruption in /var/log/btmp file.

Solution Unverified - Updated -

Environment

  • Red Hat Enterprise Linux (RHEL) 6/7
  • pam_lastlog (PAM)

Issue

  • pam_lastlog is complaining about corruption in /var/log/btmp file with following error in /var/log/secure:
Mar  1 03:48:04 testsystem sshd[80537]: pam_lastlog(sshd:session): corruption detected in /var/log/btmp

Resolution

  • 1. To resolve the corruption simply truncate the /var/log/btmp to 0 length or truncate it to some multiple of 384 bytes.

  • 2. By the way, # utmpdump /var/log/btmp can help finding where bogus entries start.

  • 3. Confirm if the disk has enough space at filesystem level where the /var/log/btmp is located.

Root Cause

  • Mostly this corruption issue happens if filesystem where /var/log/ is mounted doesn't have enough space left.

Diagnostic Steps

  • Check if the filesystem where /var/log/ is mounted has enough space:
# df -TH
  • Component
  • pam

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.