[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
bin/39444: in last(1), an empty wtmp "begins" now
>Synopsis: in last(1), an empty wtmp "begins" now
>Arrival-Date: Mon Sep 01 04:15:00 +0000 2008
>Originator: David A. Holland <dholland%eecs.harvard.edu@localhost>
>Release: NetBSD 4.99.72 (20080831)
System: NetBSD valkyrie 4.99.72 NetBSD 4.99.72 (VALKYRIE) #31: Sun Aug 3
18:48:19 EDT 2008 root@valkyrie:/usr/src/sys/arch/amd64/compile/VALKYRIE amd64
When you run last(1), it finishes up by printing the time it's reached
back to, like this:
wtmpx begins Sun Aug 31 2008 23:58:33
If wtmp is empty because nobody has logged in or out since the last
time wtmp was rotated, it prints just the timestamp. The problem: the
timestamp is $NOW, which is misleading, rather than the mtime of the
empty wtmp file, which reflects when wtmp was rotated and thus when
the wtmp actually began.
It is particularly annoying if you bring up an idle shell window to
check a system for unwanted activity, because then you have to go look
in /var/log to see if you need to also check wtmp.0.
Stay logged in for a while, then run last.
Should be trivial, except that the code in usr.bin/last is failing to
make sense to me.
Main Index |
Thread Index |