[DavidSJ]

Can someone think of a reason why the list of logins and logouts stored in /var/log/wtmp would be wiped? For some reason, I'm only seeing logins and logouts from the last 24 hours. Is there an explanation for this besides hacking?

I installed some software updates, but that was three days ago, not one day ago.

[Brass]

System logs are rotated on a regular basis (so that they don't fill your hard disk). Maybe it was just time. I've never bothered checking into when this happens by default.

[DavidSJ]

Thanks for the reply. This is the first time since I got my computer in September of '02 that the logs have been wiped. Do the old logs get compressed and stored somewhere?

I also noticed two slightly strange things today, but both have innocent explanations if the log-erasure can be explained, especially since they are relatively careless traces for someone to leave, particularly someone who took the trouble to erase my log files.

[Thinine]

wtmp is rolled with the monthly maintenance script. If you don't have your machine on 24/7, it may be a while before that script runs. Your old wtmp should be compressed and in the same directory, I think.

[DavidSJ]

I do leave my machine on 24/7.

However, it seems that you're right: a wtmp file was recently compressed in the same folder.

Thanks for your help, guys.