Re: curious wtmp date
From: Bill Marcum (bmarcum_at_iglou.com.urgent)
Date: Sat, 9 Jul 2005 00:31:03 -0400
On Fri, 08 Jul 2005 20:57:20 -0500, Philip Washington
> Another server shows
> wtmp begins Fri Jul 1 15:43:32 2005
> but doesn't show a login for this time, the first login is Jul 5
> This seems to be a little odd to me. Is this something I should be
> concerned about or is there an explanation for this other than someone is
> hacking the servers and manipulating the wtmp files.
Have you checked whether there are any "old" wtmp files?
(ls -l /var/log/*wtmp*)
Is it possible your machines have been rebooted, perhaps due to a power
-- Tonight you will pay the wages of sin; Don't forget to leave a tip.