last command stoped running
 

Hello, linux last command stop shown new login records, i disable finger command and who command, does this have any related to last issue?

wtmp file have permission -rw-rw-r--

any idea?

Not to my knowledge, wtmp is not directly associated with finger and who command.

When did it stop working? Usually wtmp to my knowledge is controlled by login, init and some versions of getty. You may have to restart the server for logging to start again if it's actually completely stopped logging users login and logout info.

There are several possibilities, but what distribution of linux are you using and what release and who is the owner and group of the file? Have you verified that the last command hasn't been tampered with?

thanks guys for your reply, today i enable telnet any connect to the server it appear on the wtmp, maybe some hardening done for the sshd.

Well if it's sshd that isn't getting logged and no changes were made and it previously worked, then restart sshd to see if that is the simple fix.