chklastlog - check lastlog-file for deleted entries
Chklastlog is reading all entries from the file /var/log/wtmp (file
with informations about logins and logouts) and checks for every user
found in this file whether there is an entry in the file
/var/log/lastlog, too. The program will complain about userids with
logins but no lastlogin information.
To run chklastlog you need read permission on the files /var/log/wtmp
and /var/log/lastlogin. Normally these files are world-readable and no
special privileges are required to run the checker.
/var/log/wtmp login data base
/var/log/lastlog last login times
wtmp(4), who(1), last(1)
This program only works if the user has not logged in after the
deletion of their lastlog entry.
This program was designed to run on SunOS 4.x systems only. On other
systems the output is undefined...