# Missing wtmp file

**URL:** <https://forums.suse.com/t/missing-wtmp-file/35585>\
**Category:** SLES Install-Boot\
**Created:** [May 4, 2021, 9:50am UTC](https://forums.suse.com/t/missing-wtmp-file/35585 "2021-05-04T09:50:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![epk](https://avatars.discourse-cdn.com/v4/letter/e/919ad9/32.png) [@epk](https://forums.suse.com/u/epk)\
**Post date:** [May 4, 2021, 9:50am UTC](https://forums.suse.com/t/missing-wtmp-file/35585/1 "2021-05-04T09:50:43Z")

</div>

We have a server running Siemens Hipath PABX whose wtmp file in the /var/log/ was accidentally deleted. Can someone help with the reconstruction of this file. Is it possible to copy it from another machine?

---

<div class="post-metadata">

**Author:** ![malcolmlewis](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/malcolmlewis/32/11375_2.png) [@malcolmlewis](https://forums.suse.com/u/malcolmlewis)\
**Post date:** [May 4, 2021, 2:03pm UTC](https://forums.suse.com/t/missing-wtmp-file/35585/2 "2021-05-04T14:03:26Z")

</div>

@epk Hi and welcome to the Forum 🙂  
Better to recreate… As root user;

```auto
touch /var/log/wtmp
chown root:utmp /var/log/wtmp
chmod 0644 /var/log/wtmp

```

---

<div class="post-metadata">

**Author:** ![epk](https://avatars.discourse-cdn.com/v4/letter/e/919ad9/32.png) [@epk](https://forums.suse.com/u/epk)\
**Post date:** [May 5, 2021, 11:28am UTC](https://forums.suse.com/t/missing-wtmp-file/35585/3 "2021-05-05T11:28:08Z")

</div>

I am getting the following message: **touch: cannot touch `/var/log/wtmp’: No space left on device**

---

<div class="post-metadata">

**Author:** ![epk](https://avatars.discourse-cdn.com/v4/letter/e/919ad9/32.png) [@epk](https://forums.suse.com/u/epk)\
**Post date:** [May 5, 2021, 11:29am UTC](https://forums.suse.com/t/missing-wtmp-file/35585/4 "2021-05-05T11:29:24Z")

</div>

my var usage is indicating 49% I don’t understand how I am getting that message.

---

<div class="post-metadata">

**Author:** ![malcolmlewis](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/malcolmlewis/32/11375_2.png) [@malcolmlewis](https://forums.suse.com/u/malcolmlewis)\
**Post date:** [May 5, 2021, 12:21pm UTC](https://forums.suse.com/t/missing-wtmp-file/35585/5 "2021-05-05T12:21:27Z")

</div>

@epk Hi, sounds like it may have been a bit more than just file removal, check all the permissions?

Are you using btrfs?

Can you show the output from;

```auto
mount

```

---

<div class="post-metadata">

**Author:** ![epk](https://avatars.discourse-cdn.com/v4/letter/e/919ad9/32.png) [@epk](https://forums.suse.com/u/epk)\
**Post date:** [May 7, 2021, 11:26am UTC](https://forums.suse.com/t/missing-wtmp-file/35585/6 "2021-05-07T11:26:06Z")

</div>

The problem was with the /var/spool/postfix/maildrop folder. I deleted number of quelled mails and there seem to be some good response.