


CHKWTMP(1)               USER COMMANDS                 CHKWTMP(1)



NAME
     chkwtmp - check wtmp-file for deleted entries

SYNOPSIS
     chkwtmp

DESCRIPTION
     _C_h_k_w_t_m_p examines the file /_v_a_r/_a_d_m/_w_t_m_p for entries with  no
     information (contaning only null-bytes). If such entries are
     found the program prints the time window  for  the  original
     entry.  This  is  done  by  displaying the timestamps of the
     wtmp-entry before and after the deleted entry.

     To  run  chkwtmp  you  need  read  permission  on  the  file
     /var/adm/wtmp.   Normally this file is world-readable and no
     special privileges are required to run the checker.

FILES
     /var/adm/wtmp       login data base

SEE ALSO
     wtmp(4), who(1)

LIMITATIONS
     An  entry  is  recognized  as  overwritten  if   the   time-
     information has been overwritten with null-bytes.

     This program was designed to run on SunOS 4.x systems  only.
     On other systems the output is undefined...


























Sun Release 4.1   Last change: Thu Oct 12 1994                  1



