Re: curious wtmp date

From: Bill Marcum (bmarcum_at_iglou.com.urgent)
Date: 07/09/05


Date: Sat, 9 Jul 2005 00:31:03 -0400

On Fri, 08 Jul 2005 20:57:20 -0500, Philip Washington
  <phwashington@comcast.net> wrote:
>
> Another server shows
> wtmp begins Fri Jul 1 15:43:32 2005
> but doesn't show a login for this time, the first login is Jul 5
>
>
> This seems to be a little odd to me. Is this something I should be
> concerned about or is there an explanation for this other than someone is
> hacking the servers and manipulating the wtmp files.
>
Have you checked whether there are any "old" wtmp files?
(ls -l /var/log/*wtmp*)
Is it possible your machines have been rebooted, perhaps due to a power
failure?

-- 
Tonight you will pay the wages of sin; Don't forget to leave a tip.


Relevant Pages

  • Re: dsquery, dsmod, etc
    ... I can use net user to create the accounts and netlocalgroups to do what I ... To set "Must enter new password on first login", you can use cusrmgr.exe from the Windows 2000 Server Resource Kit. ... Windows Server MVP ...
    (microsoft.public.windows.server.general)
  • Re: How to auto copy files when login to windows server 2003 ?
    ... Derek Yim wrote: ... located at server folder during first login to server. ...
    (microsoft.public.windows.server.active_directory)
  • RPC HTTP Multiple Logins
    ... I have a Windows 2003 server running Exchange Server 2003 ... trying to import a .PRF file to configure the Outlook ... The first login does not seem to matter but the ...
    (microsoft.public.exchange.clients)
  • Re: Sharepoint 2001 Question
    ... There is a bug with Windows XP that caches old passwords then gets confused ... I have a sharepoint portal server 2001 installed in win 2000 server. ... logs into the sharepoint server site through Window XP client machine, ... is that after the first login, the other 2 can be cancelled and the user ...
    (microsoft.public.sharepoint.portalserver)
  • Re: Sharepoint 2001 Question
    ... Thx Nick. ... I have a sharepoint portal server 2001 installed in win 2000 server. ... logs into the sharepoint server site through Window XP client machine, ... is that after the first login, the other 2 can be cancelled and the user ...
    (microsoft.public.sharepoint.portalserver)