'Last' command showing "Crash" for ftp users
Does anyone know why the last command shows 20 entries (randomly throughout all the logins) like this:
user ftpd24711 12.x.x.x Sun Oct 12 :21:35 - crash (10+20:16)
Ive never seen this before
Well beats me ,cause last shows me crashing when nothing has happened ,even when I am using the ACPI suspend it is showing crash.It is also showing crash,when
I switch runlevels and reboot.Don't know but maybe a bug?
Does anyone know why the last command shows 20 entries (randomly throughout all the logins) like this
No, I don't.
What kind of box are we talking about? Remote or local server?
What daemons are running? Wu-ftp by any chance? Updated?
Did the box crash around the time the user logged in?
Is ftpd24711 a legitimate user? A local account?
Inspected local accounts and temp dirs for anomalies?
Changes in the passwd/group/shadow files?
Bad logins reading /var/log/btmp with "lastb"? How about lastlog?
Any errors or anomalies in any of the systems logs?
Can/did you you verify integrity of the box?
|All times are GMT -5. The time now is 03:11 PM.|