RE: Last login missing

From: Toni Heinonen (Toni.Heinonen_at_teleware.fi)
Date: 07/04/04

  • Next message: Ira: "Re: Last login missing" 
    Date: Mon, 5 Jul 2004 00:30:25 +0300
To: "Milos Prudek" <prudek@bvx.cz>, <focus-linux@securityfocus.com>

    > Today I received a suspiciously looking email from my server about an
    > unexpected restart of Apache, so I logged in and there was no "Last
    > login:" information.

    One possible explanation might be, that you have newsyslog or logrotate,
    and it rotates all your logs, including login logs (utmp/xtmp/btmp what
    you have and lastlog).

    So, the logs have recently been rotated and the login routine doesn't
    find your last login (it doesn't check the rotated files, lastlog.1,
    lastlog.2 etc). 

    -- 
TONI HEINONEN 
     TELEWARE OY 
     Mob. +358 40 836 1815 / Tel. +358 (9) 3434 9110 
     Laajalahdentie 23, FIN-00330 Helsinki, Finland 
     toni@teleware.fi / www.teleware.fi
  • Next message: Ira: "Re: Last login missing"