Rebuilding wtmp

[Saint Aardvark the Carpeted]

Kyle Mott disturbed my sleep to write:
> I read a few manpages and did some google'ing, and couldn't find much of
> anything about rebuilding wtmp. I tried just moving wtmp to wtmp.old and
> then doing 'touch wtmp', then logging out and back in, but it still
> reads 31Dec69. Is there some way to fix this? Thanks all.

It's possible that there's some process holding open wtmp.  (You could
check this by adding lsof ("list open files") from ports -- *very* handy
to have around on general principle).  If this is the case, probably
the easiest way to fix things would be to rename the file, touch wtmp,
then reboot.

Interestingly enough, a Google for "wtmp freebsd" turned up this message
from the FreeBSD-Security list:

	http://archives.neohapsis.com/archives/freebsd/2001-07/0055.html

which suggests "cp /dev/null /var/log/wtmp" to fix things -- at least on
Solaris.

I am now blessing your keyboard...

-- 
Saint Aardvark the Carpeted
aardvark at saintaardvarkthecarpeted.com
Because the plural of Anecdote is Myth.