On Fri, 2004-07-16 at 07:58, edwarner99@xxxxxxxxx wrote: > I ran this command: > > last -f /var/run/utmp > casey pts/59 :0.0 Fri Jul 16 08:54 still logged > in > casey pts/14 :0.0 Sun Jul 11 08:49 gone - no > logout > casey :0 Sun Jul 11 10:09 still logged > in > reboot system boot > > How do I remove the second entry where it says > "gone-not logout"? > Thanks, > Why remove it? It simply says the connection/session terminated without a logout. How? I have no idea since that is a binary file and I would never want to edit utmp. that keeps track of all logins for all users so it is easy to follow what is happening/by whom/when If you can edit the utmp file at will, it becomes easier for a hacker to hide their tracks.
