The wtmp file records all logins and logouts. Its format is exactly like utmp except that a null user name indicates a logout on the associated terminal. Furthermore, the terminal name "~" with user name "shutdown" or "reboot" indicates a system shutdown or reboot and the pair of terminal names "|"/"}" logs the old/new system time when date(1) changes it. wtmp is maintained by login(1), and init(1) and some versions of getty(1). Neither of these programs creates the file, so if it is removed record-keeping is turned off.

Hi all,


I got the above paragraph from the below path:
http://www.csie.ntu.edu.tw/~pangfeng...an/wtmp.5.html

But when i shutdown and restarted the system it did not log inthe file /var/log/wtmp.

Only "reboot" events are logged.
"shutdown" and "startup" events are not logged

i tried on both SuSE 10 and SuSE 9.

Please let me know if there are any ways to :

1. To log "startup" and "shutdown" operations of OS.
2. To log "startup" and "shutdown" of any applications in OS.
3. Is it possible to disable this logging ??

Thanks in advance.

Generally, you can look at the /var/log folder or grep recursively for a pattern, otherwise you can use "last" command to get the latest system events.
In /var/log/wtmp is the binary, the application itself doesn't writes log files, as far as I know.
The other solution could be to write custom script to intercept those commands, and to write to a custom log file and location.