LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (http://www.linuxquestions.org/questions/linux-software-2/)
-   -   'Last' command showing "Crash" for ftp users (http://www.linuxquestions.org/questions/linux-software-2/last-command-showing-crash-for-ftp-users-108891/)

wizade 10-26-2003 09:59 PM

'Last' command showing "Crash" for ftp users
 
Does anyone know why the last command shows 20 entries (randomly throughout all the logins) like this:

user ftpd24711 12.x.x.x Sun Oct 12 :21:35 - crash (10+20:16)

??

Ive never seen this before

rch 10-27-2003 12:42 AM

Well beats me ,cause last shows me crashing when nothing has happened ,even when I am using the ACPI suspend it is showing crash.It is also showing crash,when
I switch runlevels and reboot.Don't know but maybe a bug?

unSpawn 10-27-2003 12:48 PM

Does anyone know why the last command shows 20 entries (randomly throughout all the logins) like this
No, I don't.

What kind of box are we talking about? Remote or local server?
What daemons are running? Wu-ftp by any chance? Updated?
Did the box crash around the time the user logged in?
Is ftpd24711 a legitimate user? A local account?
Inspected local accounts and temp dirs for anomalies?
Changes in the passwd/group/shadow files?
Bad logins reading /var/log/btmp with "lastb"? How about lastlog?
Any errors or anomalies in any of the systems logs?
Can/did you you verify integrity of the box?


All times are GMT -5. The time now is 01:18 AM.