Date: Mon, 17 Dec 2012 21:49:03 -0800 (PST) From: Jack Mc Lauren <jack.mclauren@yahoo.com> To: FreeBSD Global Users Mailing List <freebsd-questions@freebsd.org> Subject: using AWK - Thanks :) Message-ID: <1355809743.24362.YahooMailNeo@web160104.mail.bf1.yahoo.com>
next in thread | raw e-mail | index | archive | help
Hi all=0A=0AThank you so much my friends,=A0=0ABen=0AFrank=0APolytropon=0AD= evin=0Ayou helped me so much :) From owner-freebsd-questions@FreeBSD.ORG Tue Dec 18 05:49:28 2012 Return-Path: <owner-freebsd-questions@FreeBSD.ORG> Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 03C71870 for <freebsd-questions@freebsd.org>; Tue, 18 Dec 2012 05:49:28 +0000 (UTC) (envelope-from matthias@d2ux.net) Received: from mail.s1.d2ux.org (static.209.96.9.5.clients.your-server.de [5.9.96.209]) by mx1.freebsd.org (Postfix) with ESMTP id A733C8FC17 for <freebsd-questions@freebsd.org>; Tue, 18 Dec 2012 05:49:27 +0000 (UTC) Received: from mail.s1.d2ux.org (mail [10.0.0.3]) by mail.s1.d2ux.org (Postfix) with ESMTP id 500EE84F2CD8 for <freebsd-questions@freebsd.org>; Tue, 18 Dec 2012 06:49:26 +0100 (CET) Received: from mail.s1.d2ux.org ([10.0.0.3]) by mail.s1.d2ux.org (mail.s1.d2ux.org [10.0.0.3]) (amavisd-new, port 10024) with ESMTP id Lj9Xy_x-zuS8 for <freebsd-questions@freebsd.org>; Tue, 18 Dec 2012 06:49:24 +0100 (CET) Received: from www.s1.d2ux.org (unknown [10.0.0.4]) by mail.s1.d2ux.org (Postfix) with ESMTP id 8753D84F2D6B for <freebsd-questions@freebsd.org>; Tue, 18 Dec 2012 06:49:24 +0100 (CET) Received: from p5DDABAD0.dip.t-dialin.net (p5DDABAD0.dip.t-dialin.net [93.218.186.208]) by d2ux.org (Horde Framework) with HTTP; Tue, 18 Dec 2012 06:49:24 +0100 Date: Tue, 18 Dec 2012 06:49:24 +0100 Message-ID: <20121218064924.Horde.lzGJYCvT7TyAQBI_io0nyQ3@d2ux.org> From: Matthias Petermann <matthias@d2ux.net> To: freebsd-questions@freebsd.org Subject: Re: "last" not showing recent login activity References: <20121217195511.Horde.WiYpoIyApmatxN7nK60how2@d2ux.org> <50CF8D2B.6010908@FreeBSD.org> <50CF90E5.7000505@infracaninophile.co.uk> In-Reply-To: <50CF90E5.7000505@infracaninophile.co.uk> User-Agent: Internet Messaging Program (IMP) H5 (6.0.2) Content-Type: text/plain; charset=UTF-8; format=flowed; DelSp=Yes MIME-Version: 1.0 Content-Disposition: inline X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions <freebsd-questions.freebsd.org> List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-questions>, <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe> List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>; List-Post: <mailto:freebsd-questions@freebsd.org> List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help> List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, <mailto:freebsd-questions-request@freebsd.org?subject=subscribe> X-List-Received-Date: Tue, 18 Dec 2012 05:49:28 -0000 Hi Matthew, Zitat von Matthew Seaman <m.seaman@infracaninophile.co.uk>: > Errr... OK. Yours is a different issue with utx.log. It is not syslog > that updates utx.log but the various programs like login(1) or sshd(8) > that actually handle the authentication when you try and log in. Most > applications achieve that via the pam_lastlog(8) module. > > As to why you cannot see anything in the file beyond a certain point: > perhaps the file data got corrupted in the middle? You might be able to > tell by examining the file with hd(1) or getent(1) -- try: > > getent utmpx log /var/log/utx.log > > You might also fine the getutxent(3) man page enlightening. Thanks - that's exactly the information I was looking for. I investigated the utx.log with getent and hd. Looks like your guess is proven - it contains definitely more data than last actually shows. I did not find the reason in detail yet but I could track this down to an event occured on the affected machine during the time of the last shown data (had to perform a hardware reset due to a hanging FS snapshot, causing me to do a manual fsck). Kind regards, Matthias
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1355809743.24362.YahooMailNeo>