Bugzilla – Bug 1062163
btmp, wtmp deleted by update, possibly systemd
Last modified: 2017-10-26 10:27:21 UTC
On two different machines, my /var/log/[bw]tmp was replaced with an empty file on 2017-10-01. The times from "rpm -qa --last" seem to indicate that it was the time when systemd-234-5.1.x86_64 was installed, although [bw]tmp are not owned by any package and I didn't find anything in the systemd scripts that seems to delete [bw]tmp. On another machine, wtmp was completely deleted and I had to recreate it manually. The btmp there does not contain entries before 2017-10-06 17:57, but I can not determine whether there are entries missing before that time, although since then it is at least one entry per hour. On all these machines I found multiple entries in /var/log/zypp/history > # setting /var/log/btmp to root:root 0600. (wrong owner/group root:utmp) The first such entry is from 2017-06-21. These seem to come from an unmodified /etc/permissions, so there must be something that changes the group to utmp so that it is then reset by chkstat. I don't know whether this is related to the deletion of the files.
/etc/permissions and /usr/lib/tmpfiles.d/var.conf have conflicting default permissions for /var/log/btmp.