Re: curious wtmp date

From: Bill Marcum (bmarcum_at_iglou.com.urgent)
Date: 07/09/05


Date: Sat, 9 Jul 2005 00:31:03 -0400

On Fri, 08 Jul 2005 20:57:20 -0500, Philip Washington
  <phwashington@comcast.net> wrote:
>
> Another server shows
> wtmp begins Fri Jul 1 15:43:32 2005
> but doesn't show a login for this time, the first login is Jul 5
>
>
> This seems to be a little odd to me. Is this something I should be
> concerned about or is there an explanation for this other than someone is
> hacking the servers and manipulating the wtmp files.
>
Have you checked whether there are any "old" wtmp files?
(ls -l /var/log/*wtmp*)
Is it possible your machines have been rebooted, perhaps due to a power
failure?

-- 
Tonight you will pay the wages of sin; Don't forget to leave a tip.