Hello, Check /var/log/messages to see if anything happened before 14:49 on 7 May... are you running "logcheck"?? It emails you daily reports of important goings on... like user's crontab changes, logins, su's and other important things. it's very very useful for spotting non-normal operations like ls.
HTH... Richard. Quoting Ian Goodall <[EMAIL PROTECTED]>: > I am running a debian woody server and when I checked the last users > yesterday I a large number of logins in the list. On running the command > today I get the following: > > dev1:/home/ian# last > ian pts/0 172.16.3.195 Wed May 7 14:49 still logged in > team1 pts/0 blue99.ex.ac.uk Wed May 7 13:21 - 13:57 (00:35) > > I have run chkrootkit but nothing was found. > > I have never had this before. Am I being paranoid or is someone trying to > cover up their tracks? > > Thanks > > ijg0 > > > > -- > To UNSUBSCRIBE, email to [EMAIL PROTECTED] > with a subject of "unsubscribe". Trouble? Contact > [EMAIL PROTECTED] > > -- Richard Hobbs [EMAIL PROTECTED] http://mongeese.co.uk | http://unixforum.co.uk "There's only one way of life, and that's your own" - The Levellers _____________________________________________________ Send all your jokes to [EMAIL PROTECTED] !! To subscribe, email: [EMAIL PROTECTED]
