Re: Corrupted wtmp file under 'frozen'
email@example.com (Miquel van Smoorenburg) writes:
> In article <firstname.lastname@example.org>,
> Sven Rudolph <email@example.com> wrote:
> >Dirk Eddelbuettel <firstname.lastname@example.org> writes:
> >Here all entries but the wu-ftpd-academ-generated are shown
> >corrupted. Wild guess: wu-ftpd-academ might write old-style entries,
> No, then you would not see them.
> >last detects this and switches back to old-style mode, and all other
> >entries will be displayed corrupted.
> Nope, last is not _that_ intelligent. It can display old-style entries
> but you have to give it a special option (-o).
> Perhaps using -o you can find out what app writes the old-style entries.
> To narrow down your search: it must be a libc5-application that either runs
> as root from inetd or inittab, or is setuid.
Thanks, I think I found it: I had a not-up-to-date ssh (1.2.22-1) that
used libc5. Looks like ssh wrote wtmp without the libc-provided
functions. The computer definitely was rebooted after the libc6
upgrade, it even crashed several times ...
Sven Rudolph <email@example.com>
To UNSUBSCRIBE, email to firstname.lastname@example.org
with a subject of "unsubscribe". Trouble? Contact email@example.com