I received a mail with this subject from localhost, and with what I suppose it is the diff between wtmp and its previous version. What I'd like to know is how I can rebuild the file to see what's been the change and the logins deleted? Also.. what is the daemon that sends this messages? Thanks for any tips..