Check in /var/log and you should see a file called wtmp.1 or something similar. The logs just get rotated.
You can view it with the -f flag to last. last -f /var/log/wtmp.1 Jason Antheunis -----Original Message----- From: Ian Goodall [mailto:[EMAIL PROTECTED] Sent: Wednesday, May 07, 2003 9:52 AM To: [email protected] Subject: Have I been hacked? I am running a debian woody server and when I checked the last users yesterday I a large number of logins in the list. On running the command today I get the following: dev1:/home/ian# last ian pts/0 172.16.3.195 Wed May 7 14:49 still logged in team1 pts/0 blue99.ex.ac.uk Wed May 7 13:21 - 13:57 (00:35) I have run chkrootkit but nothing was found. I have never had this before. Am I being paranoid or is someone trying to cover up their tracks? Thanks ijg0 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
