Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When trying to execute "last" command I am getting my last logins mixed with the content from files that exists on that server.

for instance:

 <tbody tr>=0A    </         <tr>=0A  Sun Jan 20 22:18 - crash (3894+12:33)
left" bg   <tr>=0A    3D"padding:3px 9 Thu Sep  2 16:29 - crash (-5461+-4:-3
 </td>=0 sp;=0D=0A        </tr>=0D=0A  Wed Nov  2 12:41 - crash (-3696+-1:-4
                      >=0D=0A          Wed Aug 18 08:58 - crash (-5445+-21:-
               <tr>=0 =3D"padding:7px  Thu Mar 24 10:00 - crash (-3472+-23:-
h>=0D=0A                  <th align=3D Fri Jan 30 03:38 - crash (9364+07:14)
padding=        <tabl =3D"100%">=0D=0A Thu Oct 19 15:17 - crash (-4047+-3:-2

What could cause that? I am worry that somebody managed to put content from the files into last log and somehow manages to read it back revealing confidential information. I am the only user on the server.

Any help would be greatly appreciated.

share|improve this question
2  
Filesystem corruption? Especially with the "crash" messages. Can you run fsck? –  cjc Sep 19 '12 at 13:51
    
Thanks You are right :) I would accept this as the right answer –  Arius2038 Sep 20 '12 at 15:39
    
Thanks. I've submitted a formal answer. –  cjc Sep 20 '12 at 18:28
add comment

1 Answer

up vote 3 down vote accepted

The output is suggestive of filesystem corruption: there seems to be the intermingling of the content of different files, and the readable portion of the last output suggests that the machine has crashed a bunch of times.

You should run an fsck on the filesystem.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.