Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Trying to look at some of our older log files and find they're cryptic "Unix Executable Files". This particular server I'm working with is an older Mac OS X Server (10.4 - Tiger).

-rw-r-----   1 root  admin         36  1 Jun 15:48 wtmp
-rw-r--r--   1 root  admin        578 27 May 17:40 wtmp.0.gz
-rw-r-----   1 root  admin         89 26 Apr 13:57 wtmp.1.gz
-rw-r-----   1 root  admin         78 29 Mar 16:43 wtmp.2.gz
-rw-r-----   1 root  admin         69 15 Feb 17:21 wtmp.3.gz
-rw-r-----   1 root  admin        137 16 Jan 13:09 wtmp.4.gz

i'm using zless to try and view the contents of the .gz files. and what i see is unreadable:

^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@K<E0>1  ~^@^@^@^@^@^@^@shutdown^@^@^@^@^@^@^@^@

same goes for system.log.0.gz, etc... anything that's been rolled in compressed .gz files. What am i missing?

share|improve this question
Really? Even the .log files are binary garbage? That sounds weird. Show us. – Ignacio Vazquez-Abrams Jun 2 '10 at 0:33

The wtmp and utmp files are binary data - not text. Use last to view information in them.

From man utmp:

The file is a sequence of utmp structures, declared as follows in (note that this is only one of several definitions around; details depend on the version of libc):

blah, blah ... #defines and struct foo and struct bar ...

share|improve this answer
last -f <filename> is unsupported on Snow Leopard?!? Any other suggestions? – Meltemi Jun 2 '10 at 7:26
@Meltemi: Try ac -w filename. – Dennis Williamson Jun 2 '10 at 10:28
getting closer! This is helpful. ac -p -w filename gives me a list of each user's TOTAL connect time over duration of that wtmp log. Wondering if there's a way to just view the damn log and see who logged in when?!? Ah UNIX, why must you be such a P.i.t.Ass! – Meltemi Jun 2 '10 at 19:28
@Meltemi: In this case I think it's OS X specifically that's the PITA (though Unix in general is perfectly capable sometimes). The Apple docs say that wtmp is deprecated. Check the modify date on /var/log/wtmp (the main one) if it's old it's not being written to. If that's the case rename it (and make an extra backup copy - belt and suspenders style - in fact, make a backup of all wtmp files while you're at it). Then gunzip wtmp.0.gz && mv wtmp.0 wtmp and run last. It should look at the .0 file which is now named just wtmp in place of the original. Do that for each of the gzipped... – Dennis Williamson Jun 2 '10 at 20:26
...files one by one making sure to redirect output to a text file for future reference. Then put everything back like it was if you want. – Dennis Williamson Jun 2 '10 at 20:27

Simply run: gunzip system.log.0.gz

You should then see the system.log.0 file in your directory. The gunzip command, as its name suggests, unzips .gz files.

Note that in the future, you will likely encounter .tar.gz files. These can be extracted differently, using tar -xf $FILE (replace $FILE with your file).

share|improve this answer
Except that zless is already being used to view them. – Ignacio Vazquez-Abrams Jun 2 '10 at 1:01
zless avoids the requirement for gzip. but i've tried a few different codecs to unpack the gzip and all result in these cryptic (corrupt?) logname.x files – Meltemi Jun 2 '10 at 1:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.