|
wtmp seems to be written in binary, or some such format which can't be read by text editors. To see what's in that file, use the strings command.
It works like this: strings /var/log/wtmp.
The return seems to be related to who logged in, and the kernel version which is up an running.
My recommendation: don't delete the file; just zero it out like this:
su to root
cd to /var/log
/dev/null > wtmp
The last command overwrites /var/log/wtmp with nothing (you get an empty file, but leave the file in place).
|
