From owner-freebsd-questions Fri Apr 7 2:48:27 2000 Delivered-To: freebsd-questions@freebsd.org Received: from blues.jpj.net (blues.jpj.net [204.97.17.146]) by hub.freebsd.org (Postfix) with ESMTP id 42BF637B547 for ; Fri, 7 Apr 2000 02:48:16 -0700 (PDT) (envelope-from trevor@jpj.net) Received: from localhost (trevor@localhost) by blues.jpj.net (right/backatcha) with ESMTP id e379m9C27342; Fri, 7 Apr 2000 05:48:09 -0400 (EDT) Date: Fri, 7 Apr 2000 05:48:09 -0400 (EDT) From: Trevor Johnson To: "Fred J. Lomas" Cc: FreeBSD Subject: Re: wtmp begins (was: ?) In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG > What does this mean (wtmp begins Sat Apr 1 23:09:57 2000) this is > at the bottom of the page after typing (last)................. ?? :-) When users log in or log out, these events are usually recorded in /var/log/wtmp, whence the "last" command reads that information. The message just means there aren't any entries before that date. If you've not been hacked, then the file was rotated by the newsyslog program (run by cron every hour). My /etc/newsyslog.conf (FreeBSD 4.0) has this entry: /var/log/wtmp 644 3 * @01T05 B The "01T05" means the file will be rotated on the first day of the month at 5:00. __ Trevor Johnson To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message