last command stoped running

Dr_Death_UAE · 12-23-2008, 01:04 AM

Hello, linux last command stop shown new login records, i disable finger command and who command, does this have any related to last issue?

wtmp file have permission -rw-rw-r--

any idea?

trickykid · 12-23-2008, 12:32 PM

Not to my knowledge, wtmp is not directly associated with finger and who command.

When did it stop working? Usually wtmp to my knowledge is controlled by login, init and some versions of getty. You may have to restart the server for logging to start again if it's actually completely stopped logging users login and logout info.

rweaver · 12-23-2008, 01:21 PM

Quote:

Originally Posted by Dr_Death_UAE

Hello, linux last command stop shown new login records, i disable finger command and who command, does this have any related to last issue?

wtmp file have permission -rw-rw-r--

any idea?

There are several possibilities, but what distribution of linux are you using and what release and who is the owner and group of the file? Have you verified that the last command hasn't been tampered with?

Dr_Death_UAE · 12-24-2008, 01:55 AM

thanks guys for your reply, today i enable telnet any connect to the server it appear on the wtmp, maybe some hardening done for the sshd.

trickykid · 12-24-2008, 08:52 AM

Quote:

Originally Posted by Dr_Death_UAE

thanks guys for your reply, today i enable telnet any connect to the server it appear on the wtmp, maybe some hardening done for the sshd.

Well if it's sshd that isn't getting logged and no changes were made and it previously worked, then restart sshd to see if that is the simple fix.