[prev in list] [next in list] [prev in thread] [next in thread] 

List:       suse-linux-e
Subject:    Re: [SLE] gone - logout
From:       Jerry Feldman <gaf () h0020780e341c ! ne ! client2 ! attbi ! com>
Date:       2003-02-02 20:14:12
[Download RAW message or body]


The last command uses the wtmp file. ( /var/log/wtmp). Unlike utmp, the
wtmp file is written to directly. 
The wtmp file seems to have some corrupted entries. This could be the
result of an upgrade where a previous version of wtmp was used. Or, some
process was writing into wtmp. 
My suggestion:
Zero the wtmp file. (remove it and touch it). If you see those entries
again try to track down the app that is corrupting it, such as a telnet
or ssh client. 
On Sun, 2 Feb 2003 20:10:13 +0100
Pep Serrano <pep.serrano@montblanc.homeip.net> wrote:

> Hello friends,
> 
> I getting scared when I read the following lines on my "last":
> 
> pep@montblanc:~> last
> pep      pts/1                         Sun Feb  2 20:02   still logged
> in pep      pts/0                         Sun Feb  2 20:00   still
> logged in P***(*** ****P***h*** ********P******* Thu Jan  1 01:00   
> gone - no logout pep      pts/2                         Sat Feb  1
> 23:43 - 23:44  (00:00) pep      pts/2                         Sat Feb 
> 1 23:35 - 23:37  (00:01) pep      pts/1                         Sat
> Feb  1 23:34 - 23:44  (00:10) simon    pts/0        pooladsl-a-25-7.
> Sat Feb  1 22:55 - 01:14  (02:19) camio    pts/0                      
>   Sat Feb  1 20:59 - 21:55  (00:55)
> P***h*** ****P***(*** *****            Thu Jan  1 01:00    gone - no
> logout...
> 
> Anyone has any idea where does it come from? I'm going to research in
> detail in every log file. Any suggestions about what to look for?
> 
> Thanks,
> Pep.
> 
> -- 
> Check the headers for your unsubscription address
> For additional commands send e-mail to suse-linux-e-help@suse.com
> Also check the archives at http://lists.suse.com
> Please read the FAQs: suse-linux-e-faq@suse.com
> 
> 
> 

[Attachment #3 (application/pgp-signature)]

[prev in list] [next in list] [prev in thread] [next in thread]