Steve,
Since the wtmp displays "..still logged in..", one approach could be to
try "netstat -n --inet --listening" (at command prompt). This will show any
active and "listening" inet connections to any ports provided by any
services you may have functioning. If there is an active connection, the IP
and port of the "connecter" will also be displayed, and can give you a point
to start from. There may also be an entry in /var/log/secure that could
give a clue.
Bill Fox
AIS Dept, LAN/WAN Div
NASL
-----Original Message-----
From: Steve Smith <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED] <[EMAIL PROTECTED]>
Date: Friday, June 12, 1998 3:59 PM
Subject: weird entry in wtmp
>I keep seeing output from 'last' like:
>
>d********** ***** * Fri Jun 12 05:15 still logged in
>xF*@******* otify ***@ Thu Jun 11 10:52 - down
>
>w or who don't show anyone logged in, either does /var/log/messages. What
>is this junk?
>
>
>Steve Smith
>National Renewable Energy Laboratory
>1617 Cole Blvd /|\
>Golden, CO 80401 *
> * *
> <--* *--> NREL
> * *
>Phone: (303)384-6625 *
>FAX: (303)384-6604 \|/
>email: [EMAIL PROTECTED]
>http://nsom.eecs.umich.edu/~steve/
>
>
>
>
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
http://www.redhat.com/RedHat-FAQ /RedHat-Errata /RedHat-Tips /mailing-lists
To unsubscribe: mail [EMAIL PROTECTED] with
"unsubscribe" as the Subject.
