Linux 2.6 - man page for chkwtmp (linux section 1)
|Linux & Unix Commands - Search Man Pages
chkwtmp - check wtmp-file for deleted entries
Chkwtmp examines the file /var/log/wtmp for entries with no information (containing only
null-bytes). If such entries are found the program prints the time window for the original
entry. This is done by displaying the timestamps of the wtmp-entry before and after the
To run chkwtmp you need read permission on the file /var/log/wtmp. Normally this file is
world-readable and no special privileges are required to run the checker.
/var/log/wtmp login data base
An entry is recognized as overwritten if the time-information has been overwritten with
This program was designed to run on SunOS 4.x systems only. On other systems the output is
7th Edition Thu Oct 12 1994 CHKWTMP(1)
All times are GMT -4. The time now is 02:39 AM.