Re: last log related question

[eim <eim@eimbox.org>]

I found the answers to my own question,
the old wtmp file was switched to wtmp.1 during
anacron, so there are my logs.

Well, wtmp just logs system access from users
or direct root access, but it doesnt't log any 'su' sessions.

Are the su sessions only logged in /var/log/auth.log,
or anywhere else, too ? 

And are there some nice tools to check easily those su logfiles ?

Thanks for help
 - Ivo

On Tue, 2002-01-01 at 18:30, eim wrote:
> First of all Happy new Year to everyone on this list !
> 
> Ok now, here's my problem...
> I have some pubblic boxes on which I run different pubblic services
> oviously I check for security issues on those system in order
> to keep them secure.
> 
> Last time I logged in as root and ran the command 'last'
> I saw that there where no logs, the output was just:
> 
> ~# last root
> wtmp begins Tue Jan  1 18:29:15 2002
> 
> That's all, anyone has hacked my box and deleted my last logs ?
> Or just some 'crontab-joke' ?
> 
> Thanks to everyone for suggestions,
> 
>  -Ivo
> 
> 
> -- 
> 
>  »« »« »« »« »« »« »« »« »« »« »« »« »« »« »«
>  Ivo Marino                    eim@eimbox.org
>  UN*X Developer, running Debian GNU/Linux
>  irc.OpenProjects.net #debian
>  http://eimbox.org
>  »« »« »« »« »« »« »« »« »« »« »« »« »« »« »«
> 
> 
> -- 
> To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
> 
-- 

 »« »« »« »« »« »« »« »« »« »« »« »« »« »« »«
 Ivo Marino                    eim@eimbox.org
 UN*X Developer, running Debian GNU/Linux
 irc.OpenProjects.net #debian
 http://eimbox.org
 »« »« »« »« »« »« »« »« »« »« »« »« »« »« »«