[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: have I been hacked?

On 9 Feb 2002, Chris Cameron wrote:

> wtmp turns over every once in a while. I don't know when it does it, and it
> doesn't bother me. Check /var/log/wtmp.0.gz and I'm almost 100% sure you'll
> find your past logins there.

man newsyslog

cat /etc/newsyslog.conf

which, by default, says this about wtmp:
/var/log/wtmp                           644  7    *    168   ZB

so wtmp gets rolled once a week (168hrs)


d neal wise - nwise_(_at_)_spy_(_dot_)_net
SPY internetworking  -  will network for food

Visit your host, monkey.org