From owner-freebsd-questions@FreeBSD.ORG Tue Dec 18 05:49:04 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 9FE007D1 for ; Tue, 18 Dec 2012 05:49:04 +0000 (UTC) (envelope-from jack.mclauren@yahoo.com) Received: from nm11.bullet.mail.bf1.yahoo.com (nm11.bullet.mail.bf1.yahoo.com [98.139.212.170]) by mx1.freebsd.org (Postfix) with ESMTP id 3D1FC8FC1B for ; Tue, 18 Dec 2012 05:49:04 +0000 (UTC) Received: from [98.139.212.147] by nm11.bullet.mail.bf1.yahoo.com with NNFMP; 18 Dec 2012 05:49:03 -0000 Received: from [98.139.212.196] by tm4.bullet.mail.bf1.yahoo.com with NNFMP; 18 Dec 2012 05:49:03 -0000 Received: from [127.0.0.1] by omp1005.mail.bf1.yahoo.com with NNFMP; 18 Dec 2012 05:49:03 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 485731.87970.bm@omp1005.mail.bf1.yahoo.com Received: (qmail 58031 invoked by uid 60001); 18 Dec 2012 05:49:03 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1355809743; bh=amk/Skb9funDykCDew5XCNxIrVSBMTw7qwrqR1ZcteE=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=vblidJCQ0px4czMy6Az/r3TJmYpxbeEVFDiVwO0eg6PCEigl4j64t43cOWfEXzm2NLz3dlufpVVCXJMZnuMXgbvx/nBgpqXRxiuDvuh3fJJF+twox/01zMTjrLQ8kjjaamDmWMuOEHyl2oMeWhZAYeluJec3tyDjWjlaNbbYRV8= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=fGnq/5ffyrwhSnGVAUiJ6Y8hwTyhk7JWtp3BUgkFy9c72R3sbUcpJvKfb6lQ6mF0hR9n05g0Am/2qclvR5igU3sGixfv9otuzUGMy6cQNlO/98riro5KmvEUUYer/9gTHGT1xxRk9SzwV8uNl/GuGoLi/r+Dy2wX+zwaCFZr1QM=; X-YMail-OSG: vR0YlS0VM1lDpo3Ekgt5NswtTyAATz040sHT4zNEZ_k0eMM DOfXhw5pqHP7ngmG39D8g Received: from [89.165.120.140] by web160104.mail.bf1.yahoo.com via HTTP; Mon, 17 Dec 2012 21:49:03 PST X-Rocket-MIMEInfo: 001.001, SGkgYWxsCgpUaGFuayB5b3Ugc28gbXVjaCBteSBmcmllbmRzLMKgCkJlbgpGcmFuawpQb2x5dHJvcG9uCkRldmluCnlvdSBoZWxwZWQgbWUgc28gbXVjaCA6KQEwAQEBAQ-- X-Mailer: YahooMailWebService/0.8.129.483 Message-ID: <1355809743.24362.YahooMailNeo@web160104.mail.bf1.yahoo.com> Date: Mon, 17 Dec 2012 21:49:03 -0800 (PST) From: Jack Mc Lauren Subject: using AWK - Thanks :) To: FreeBSD Global Users Mailing List MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.14 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: Jack Mc Lauren List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Dec 2012 05:49:04 -0000 Hi all=0A=0AThank you so much my friends,=A0=0ABen=0AFrank=0APolytropon=0AD= evin=0Ayou helped me so much :) From owner-freebsd-questions@FreeBSD.ORG Tue Dec 18 05:49:28 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 03C71870 for ; Tue, 18 Dec 2012 05:49:28 +0000 (UTC) (envelope-from matthias@d2ux.net) Received: from mail.s1.d2ux.org (static.209.96.9.5.clients.your-server.de [5.9.96.209]) by mx1.freebsd.org (Postfix) with ESMTP id A733C8FC17 for ; Tue, 18 Dec 2012 05:49:27 +0000 (UTC) Received: from mail.s1.d2ux.org (mail [10.0.0.3]) by mail.s1.d2ux.org (Postfix) with ESMTP id 500EE84F2CD8 for ; Tue, 18 Dec 2012 06:49:26 +0100 (CET) Received: from mail.s1.d2ux.org ([10.0.0.3]) by mail.s1.d2ux.org (mail.s1.d2ux.org [10.0.0.3]) (amavisd-new, port 10024) with ESMTP id Lj9Xy_x-zuS8 for ; Tue, 18 Dec 2012 06:49:24 +0100 (CET) Received: from www.s1.d2ux.org (unknown [10.0.0.4]) by mail.s1.d2ux.org (Postfix) with ESMTP id 8753D84F2D6B for ; Tue, 18 Dec 2012 06:49:24 +0100 (CET) Received: from p5DDABAD0.dip.t-dialin.net (p5DDABAD0.dip.t-dialin.net [93.218.186.208]) by d2ux.org (Horde Framework) with HTTP; Tue, 18 Dec 2012 06:49:24 +0100 Date: Tue, 18 Dec 2012 06:49:24 +0100 Message-ID: <20121218064924.Horde.lzGJYCvT7TyAQBI_io0nyQ3@d2ux.org> From: Matthias Petermann To: freebsd-questions@freebsd.org Subject: Re: "last" not showing recent login activity References: <20121217195511.Horde.WiYpoIyApmatxN7nK60how2@d2ux.org> <50CF8D2B.6010908@FreeBSD.org> <50CF90E5.7000505@infracaninophile.co.uk> In-Reply-To: <50CF90E5.7000505@infracaninophile.co.uk> User-Agent: Internet Messaging Program (IMP) H5 (6.0.2) Content-Type: text/plain; charset=UTF-8; format=flowed; DelSp=Yes MIME-Version: 1.0 Content-Disposition: inline X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Dec 2012 05:49:28 -0000 Hi Matthew, Zitat von Matthew Seaman : > Errr... OK. Yours is a different issue with utx.log. It is not syslog > that updates utx.log but the various programs like login(1) or sshd(8) > that actually handle the authentication when you try and log in. Most > applications achieve that via the pam_lastlog(8) module. > > As to why you cannot see anything in the file beyond a certain point: > perhaps the file data got corrupted in the middle? You might be able to > tell by examining the file with hd(1) or getent(1) -- try: > > getent utmpx log /var/log/utx.log > > You might also fine the getutxent(3) man page enlightening. Thanks - that's exactly the information I was looking for. I investigated the utx.log with getent and hd. Looks like your guess is proven - it contains definitely more data than last actually shows. I did not find the reason in detail yet but I could track this down to an event occured on the affected machine during the time of the last shown data (had to perform a hardware reset due to a hanging FS snapshot, causing me to do a manual fsck). Kind regards, Matthias