I found the answers to my own question, the old wtmp file was switched to wtmp.1 during anacron, so there are my logs.
Well, wtmp just logs system access from users or direct root access, but it doesnt't log any 'su' sessions. Are the su sessions only logged in /var/log/auth.log, or anywhere else, too ? And are there some nice tools to check easily those su logfiles ? Thanks for help - Ivo On Tue, 2002-01-01 at 18:30, eim wrote: > First of all Happy new Year to everyone on this list ! > > Ok now, here's my problem... > I have some pubblic boxes on which I run different pubblic services > oviously I check for security issues on those system in order > to keep them secure. > > Last time I logged in as root and ran the command 'last' > I saw that there where no logs, the output was just: > > ~# last root > wtmp begins Tue Jan 1 18:29:15 2002 > > That's all, anyone has hacked my box and deleted my last logs ? > Or just some 'crontab-joke' ? > > Thanks to everyone for suggestions, > > -Ivo > > > -- > > »« »« »« »« »« »« »« »« »« »« »« »« »« »« »« > Ivo Marino [EMAIL PROTECTED] > UN*X Developer, running Debian GNU/Linux > irc.OpenProjects.net #debian > http://eimbox.org > »« »« »« »« »« »« »« »« »« »« »« »« »« »« »« > > > -- > To UNSUBSCRIBE, email to [EMAIL PROTECTED] > with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] > -- »« »« »« »« »« »« »« »« »« »« »« »« »« »« »« Ivo Marino [EMAIL PROTECTED] UN*X Developer, running Debian GNU/Linux irc.OpenProjects.net #debian http://eimbox.org »« »« »« »« »« »« »« »« »« »« »« »« »« »« »«
