Jerry Feldman [Sun, 2 Feb 2003 15:14:12 -0500]:

Zero the wtmp file. (remove it and touch it).

Why two commands when one suffices? Just do an empty redirect:

/var/log/wtmp

Philipp -- Philipp Thomas work: pthomas@suse.de Development SuSE Linux AG private: pth@t-link.de

I hope it's just a corrupted file. The first feeling you get from a bizarre entry in your "last" is "they're in!" Anyway I keep a big eye open at the moment. So, in addition to check every single log line, do you suggest a way to track who is corrupting the wtmp? Cheers, Pep. ----- Original Message ----- From: "Jerry Feldman"

Zero the wtmp file. (remove it and touch it). If you see those entries again try to track down the app that is corrupting it, such as a telnet or ssh client.

Alle 17:19, lunedì 3 febbraio 2003, Jerry Feldman ha scritto:

On Mon, 3 Feb 2003 15:30:08 +0100

"Pep Serrano" wrote:

...

I hope it's just a corrupted file. The first feeling you get from a bizarre entry in your "last" is "they're in!" Anyway I keep a big eye open at the moment.

So, in addition to check every single log line, do you suggest a way to track who is corrupting the wtmp?

That's not easy. I've actually done that. Compaq's Tru64 Unix changed the layout between versions 4 and 5. (I was the guy who actually did that). One of our system admins was complaining that the last command was incorrect on our main server. We tracked the problem to an old version of the ssh daemon. There are only a limited number of utilities that write to wtmp. These are utilities that perform loging and logouts.

There is another one... netdate. Praise