CHKLASTLOG(8)

💖 chklastlog — bestie edition 💖

okay so this is chklastlog, and it lives in section 8 of the System Manager's Manual (System Manager's Manual, the admin-y part of the manual, iykyk). it's a little forensics bestie that sniffs out sneaky deleted logins. let's get into it 🕵️♀️✨

✨ NAME ✨

chklastlog — check the lastlog file for deleted entries, fr fr 💅

🌸 SYNOPSIS 🌸

chklastlog looks for users whose login has been erased from the lastlog database. that's it, that's the whole vibe check 👑

🦋 DESCRIPTION 🦋

okay so here's the tea. chklastlog reads all the entries from /var/log/wtmp (which is, like, a whole database of info about logins and logouts, very main character of it) and then checks that every single user it finds in that file actually has an entry in /var/log/lastlog.

then it lists any users who have logins in wtmp but no lastlogin information. and bestie… that's a red flag 🚩 because it may suggest the user account has been compromised and the attacker has tried to cover their tracks. like, not me deleting the receipts 🙈💀

chklastlog needs to be able to read /var/log/wtmp and /var/log/lastlogin. the good news? normally these files are world-readable, so no special privileges are required. no sudo moment needed, we love that for us 🫶

🎀 FILES 🎀

• /var/log/wtmp — database of logins and logouts. the whole social calendar, basically 📅
• /var/log/lastlog — database which contains info on the last login of each user. the "last seen" feature but make it Unix 💜

🌈 SEE ALSO 🌈

wtmp(5), who(1), lastlog(8), last(1) — go read those too, they're iconic, no cap ⭐

💀 LIMITATIONS 💀

okay, reality check time, and this part is important so listen up:

• wtmp may itself be incomplete, because not all programmes record their activity using utmp logging. see wtmp(8). so like, the data can be missing pieces before you even start 🫠
• chklastlog will not detect missing entries if the user has logged in after the lastlog entry was deleted. so if they came back around, the evidence is just… gone. tragic 😭
• this program was originally designed to run on SunOS 4.x systems. on other systems the output is undefined. so yeah, on anything else it's giving chaos, and we're not gonna pretend otherwise. consider yourself warned 🚨

undefined output is not a vibe. don't build your whole incident response on it if you're not on SunOS 4.x, bestie.

mwah, that's the whole page 💖 this little cutie comes from the System Manager's Manual and the version/date on the tin is Oct 23, 2021. stay safe out there, keep your logs, and never let anyone erase your lastlogin info 👑💅✨