Hi,

I,ve a Unixware 7.1.3 working correctly for two years ago, since a several weeks I've a problem with the command last . The information that this command return is :

For example :

1.- The user root , time login : 12:15 h, time logoff 12:15 h (the real time is 14:00). Connected time is 00:00 h.

This occurss always with all users. I tested the files of the directory /var/adm : utmp, utmpx, wtmp, wtmpx, lastlog, syslog. I changed this files for another files (ok) the other servers, always with the same result. I tried to edit this files, but these are data files, I know that the problem is that the system is saving bad datas in these files, but I need one way to continue the search.

Thanks,

Is the actual system date/time correct?

Assuming you haven't been hacked I'd try recreating thouch files ">wtmpx" for example.

If you really want to dig into it, check out struct utmp. You can write a program to search through the files record-by-record. It's not too bad with Perl.

Hi mdhmi,

I tried all that you to tell me. Te date/time is correct. Too I cleaned and created the files utmp, utmpx, wtmp and wtmpx.

Thanks..