Do someone know how to delete entry(some lines)
in file "wtmpx" that command "last" use it.

this file is binary so I cannot edit directy.

=========================
#last
root pts/1 noc Fri Mar 3 22:04 still logged in
root pts/1 noc Fri Mar 3 22:01 - 22:02 (00:00)
root pts/1 noc Fri Mar 3 21:50 - 21:51 (00:00)
root pts/1 noc Fri Mar 3 21:46 - 21:46 (00:00)
root console Fri Mar 3 20:20 still logged in
few pts/2 narisara Fri Mar 3 18:43 - 18:43 (00:00)
=========================

I want to delete entry of user "few" from command "last".

the only reason i can think of why you would want to do something like that involves hackers and erasing footsteps ... if you really want to edit the entries in that file --- you have to edit it with your own custom C/C++ program ...

or ...

you can delete all entries in 1 shot --- legally and routinely done by SAs trying to make space on a full "/" partition --- in ksh and as root, run '> /var/adm/wtmpx' ...

if you have appropriate permission to edit the /var/adm/wtmpx file
then use the utmpx structure and with getutxent function
read the file and modify to eliminate the entries from the file

get the utmpx structure from utmpx.h

Thank you for both infomations ,and I'm not hacker .

new question is : If I can get entry from this file ,how to put new entry
to it ?

adding entry to the file /var/adm/wtmpx

i havent tried this myself but it should work

populate the utmpx structure
and write to the file as structure

that would do !!!