1

Trying to look at some of our older log files and find they're cryptic "Unix Executable Files". This particular server I'm working with is an older Mac OS X Server (10.4 - Tiger).

-rw-r-----   1 root  admin         36  1 Jun 15:48 wtmp
-rw-r--r--   1 root  admin        578 27 May 17:40 wtmp.0.gz
-rw-r-----   1 root  admin         89 26 Apr 13:57 wtmp.1.gz
-rw-r-----   1 root  admin         78 29 Mar 16:43 wtmp.2.gz
-rw-r-----   1 root  admin         69 15 Feb 17:21 wtmp.3.gz
-rw-r-----   1 root  admin        137 16 Jan 13:09 wtmp.4.gz

i'm using zless to try and view the contents of the .gz files. and what i see is unreadable:

...
<DF>^R<AF>ttyp1^@^@^@joe54^@^@^@^@^@108.184.63.22^@^@^@^@K<DF>"<B8>ttyp1^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@K<DF>%<A1>console^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@K<E0>1  ~^@^@^@^@^@^@^@shutdown^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@K<E0>1^L~^@^@^@^@^@^@^@reboot^@^@^@^@^@^@
...

same goes for system.log.0.gz, etc... anything that's been rolled in compressed .gz files. What am i missing?

1
  • Really? Even the .log files are binary garbage? That sounds weird. Show us. Jun 2, 2010 at 0:33

3 Answers 3

1

The wtmp and utmp files are binary data - not text. Use last to view information in them.

From man utmp:

The file is a sequence of utmp structures, declared as follows in (note that this is only one of several definitions around; details depend on the version of libc):

blah, blah ... #defines and struct foo and struct bar ...

5
  • last -f <filename> is unsupported on Snow Leopard?!? Any other suggestions?
    – Meltemi
    Jun 2, 2010 at 7:26
  • 1
    @Meltemi: Try ac -w filename. Jun 2, 2010 at 10:28
  • getting closer! This is helpful. ac -p -w filename gives me a list of each user's TOTAL connect time over duration of that wtmp log. Wondering if there's a way to just view the damn log and see who logged in when?!? Ah UNIX, why must you be such a P.i.t.Ass!
    – Meltemi
    Jun 2, 2010 at 19:28
  • @Meltemi: In this case I think it's OS X specifically that's the PITA (though Unix in general is perfectly capable sometimes). The Apple docs say that wtmp is deprecated. Check the modify date on /var/log/wtmp (the main one) if it's old it's not being written to. If that's the case rename it (and make an extra backup copy - belt and suspenders style - in fact, make a backup of all wtmp files while you're at it). Then gunzip wtmp.0.gz && mv wtmp.0 wtmp and run last. It should look at the .0 file which is now named just wtmp in place of the original. Do that for each of the gzipped... Jun 2, 2010 at 20:26
  • ...files one by one making sure to redirect output to a text file for future reference. Then put everything back like it was if you want. Jun 2, 2010 at 20:27
0

Simply run: gunzip system.log.0.gz

You should then see the system.log.0 file in your directory. The gunzip command, as its name suggests, unzips .gz files.

Note that in the future, you will likely encounter .tar.gz files. These can be extracted differently, using tar -xf $FILE (replace $FILE with your file).

2
  • 1
    Except that zless is already being used to view them. Jun 2, 2010 at 1:01
  • zless avoids the requirement for gzip. but i've tried a few different codecs to unpack the gzip and all result in these cryptic (corrupt?) logname.x files
    – Meltemi
    Jun 2, 2010 at 1:44
0

Have you tried running it with gz tool instead of just z for example gzcat wtmp.0.gz?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .