|CHKWTMP(8)||System Manager's Manual||CHKWTMP(8)|
chkwtmp - check wtmp file deleted entries
chkwtmp looks for data deleted from wtmp
chkwtmp examines the file /var/log/wtmp for entries which have been overwritten (containing only null-bytes). If such entries are found the program displays the timestamps of the entries before and after the deleted entry, providing an idea of when the entry was deleted.
chkwtmp needs to be able to read /var/log/wtmp. Normally this file is world-readable so no special privileges are required.
- database of logins and logouts.
An entry is recognized as overwritten if the time-information has been overwritten with null-bytes.
This program was originally designed to run on SunOS 4.x systems. On other systems the output is undefined.
|October 23, 2021|