Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When trying to execute "last" command I am getting my last logins mixed with the content from files that exists on that server.

for instance:

 <tbody tr>=0A    </         <tr>=0A  Sun Jan 20 22:18 - crash (3894+12:33)
left" bg   <tr>=0A    3D"padding:3px 9 Thu Sep  2 16:29 - crash (-5461+-4:-3
 </td>=0 sp;=0D=0A        </tr>=0D=0A  Wed Nov  2 12:41 - crash (-3696+-1:-4
                      >=0D=0A          Wed Aug 18 08:58 - crash (-5445+-21:-
               <tr>=0 =3D"padding:7px  Thu Mar 24 10:00 - crash (-3472+-23:-
h>=0D=0A                  <th align=3D Fri Jan 30 03:38 - crash (9364+07:14)
padding=        <tabl =3D"100%">=0D=0A Thu Oct 19 15:17 - crash (-4047+-3:-2

What could cause that? I am worry that somebody managed to put content from the files into last log and somehow manages to read it back revealing confidential information. I am the only user on the server.

Any help would be greatly appreciated.

share|improve this question
Filesystem corruption? Especially with the "crash" messages. Can you run fsck? – cjc Sep 19 '12 at 13:51
Thanks You are right :) I would accept this as the right answer – Pawel Dubiel Sep 20 '12 at 15:39
Thanks. I've submitted a formal answer. – cjc Sep 20 '12 at 18:28
up vote 3 down vote accepted

The output is suggestive of filesystem corruption: there seems to be the intermingling of the content of different files, and the readable portion of the last output suggests that the machine has crashed a bunch of times.

You should run an fsck on the filesystem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.