Sorry,
I just discovered, that it happened due to the disk partition being
filled up at some point, and wtmp became corrupted.

This brings another thought: it might be a good feature if login(1)
would be able to determine the disk space shortage, make a note for that
in wtmp, and stop logging until the disk space becomes available
(pretty much the way syslogd(8) handles such situation).

Regards,

Igor

I wrote earlier:

> Date: Sat, 7 Jul 2001 18:20:19 -0400 (EDT)
> From: Igor Roshchin <strgiganda.komkon.org>
> To: securityFreeBSD.ORG
> Subject: wtmp corrupted - ?
>
>
> Hello!
>
> I've just found that my wtmp file is corrupted.
> (See the output of last(1) below).
> Is this a bug or is it a sign of somebody trying to clear his trace ?
> (This is on 4.3-RELEASE).
>
> Are there any tools around which allow to easily read a corrupted wtmp ?
>
> thanks,
>
> Igor
>
> 50.85 200.191. 3408 Wed Dec 31 19:00 still logged in
> 50.85 200.191. 3378 Wed Dec 31 19:00 still logged in
> 5.134 63.29.16 3378ftp Wed Dec 31 19:00 still logged in
> .112 38.16.82 3359str Wed Dec 31 19:00 still logged in
> 56.169 212.57.1 3313 Wed Dec 31 19:00 still logged in
> 56.169 212.57.1 3313ftp Wed Dec 31 19:00 still logged in
> 176.69 211.133. 3058 Wed Dec 31 19:00 still logged in
> 8.215 213.44.5 3058ftp Wed Dec 31 19:00 still logged in
> 7.228 202.225. 3042 Wed Dec 31 19:00 still logged in
> 8.215 213.44.5 3042ftp Wed Dec 31 19:00 still logged in
> 8.215 213.44.5 3005 Wed Dec 31 19:00 still logged in
> 98.203 217.80.1 2976 Wed Dec 31 19:00 still logged in
> 8.215 213.44.5 2974 Wed Dec 31 19:00 still logged in
> 98.203 217.80.1 2976ftp Wed Dec 31 19:00 still logged in
> 148.201 200.236. 2974ftp Wed Dec 31 19:00 still logged in
>
>
> To Unsubscribe: send mail to majordomoFreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>

To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]