Subj : Re: Help - /bin/login overwriting active utmp entries
To   : alt.comp.linux,comp.os.linux,comp.os.linux.redhat
From : Robert Newson
Date : Tue Jun 29 2004 10:03 am

Tim Underwood wrote:

....
> This seems to be a SERIOUS bug.  I can't tell who's logged in, and who
> isn't.  I also understood that the utmp file was to be a history of logins -
> so why would /bin/login (I presume that's who's writing the entries) be
> overwriting the utmp records anyway?

[/var/run/]utmp is the file of who is currently logged in.

[/var/log/]wtmp is the file of who has logged in and logged out - every time 
someone logs in/out an entry is added to this file; the "last" command uses 
it to find out when people last logged in and for how long (by finding the 
corresponding logout entry).  If the system crashes, the "last" command 
should be able to tell you who was using the system when it crashed.

.