Copyright (c) DFN-CERT, Univ. of Hamburg 1994 Univ. Hamburg, Dept. of Computer Science DFN-CERT Vogt-Koelln-Strasse 30 22527 Hamburg Germany @(#) $Header: chkwtmp.1,v
NAMEchkwtmp - check wtmp-file for deleted entries
Chkwtmp examines the file /var/log/wtmp for entries with no
information (containing only null-bytes). If such entries are found the
program prints the time window for the original entry. This is done
by displaying the timestamps of the wtmp-entry before and after the
To run chkwtmp you need read permission on the file /var/log/wtmp. Normally this file is world-readable and no special privileges are required to run the checker.
- login data base
SEE ALSOwtmp(4), who(1)
LIMITATIONSAn entry is recognized as overwritten if the time-information has been overwritten with null-bytes.
This program was designed to run on SunOS 4.x systems only. On other systems the output is undefined...