[95390] in RedHat Linux List
Re: who, w, last still giving me fits.
daemon@ATHENA.MIT.EDU (Jan Carlson)
Sat Oct 17 20:22:23 1998
Date: Sun, 18 Oct 1998 00:16:20 +0000
From: Jan Carlson <janc@iname.com>
To: redhat-list@redhat.com
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
Joel Robert Oliveira wrote:
> *sigh*
>
> So far this is what I know about my problems, the system's young, more
> than likely was _not_ hacked and files were not changed. But, here it is,
> IF it was how would i go about making sure these files were put back in,
> and in working condition? Oh yes, and what files are associated with this
> ? utmp, wtmp, who, w, last ? those are the ones I'm concerned with...
Maybe there is a problem with the data files these commands use!
Check the permissions and owner of these two files:
-rw-r--r-- 1 root root 501504 Oct 17 19:02 /var/log/wtmp
-rw-r--r-- 1 root root 4608 Oct 17 19:13 /var/run/utmp
The sizes and dates do not matter. Also check the directories that
contain them:
drwxr-xr-x 6 root root 1024 Oct 15 13:24 /var/log
drwxr-xr-x 4 root root 1024 Oct 17 19:45 /var/run
And be sure the filesystem containing /var is not full.
If these things all check out, you could try out the theory that
the data files are corrupt. The easy way to fix these two
data files is to truncate them. Save a copy first.
cd /var/log
cp wtmp wtmp.saveme
> wtmp
cd /var/run
cp utmp utmp.saveme
>utmp
Then shutdown -r now.
If who and last start
working again, something corrupted
utmp and wtmp. Possibly someone
covering his tracks... In that case,
for sure have a look at the two saveme files.
Try strings -a wtmp.saveme | less
>
>
> tia,
>
> Joel
>
--
Jan Carlson
janc@iname.com Scarborough, Ontario, Canada
Mailed with Netscape 4.07 on Red Hat Linux 5.1
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
http://www.redhat.com http://archive.redhat.com
To unsubscribe: mail redhat-list-request@redhat.com with
"unsubscribe" as the Subject.
