CHKWTMP(8)

💖 CHKWTMP — the chkwtmp(8) girlies' edition 💖

okay bestie, so this is a page from the System Manager's Manual and it's about a lil program called chkwtmp. it's giving forensic detective energy, honestly. let's get into it 🕵️♀️✨

---

🌸 NAME 🌸

chkwtmp — check wtmp file deleted entries

like. it checks the wtmp file. for deleted entries. that's the whole vibe 💅

---

✨ SYNOPSIS ✨

chkwtmp looks for data deleted from wtmp

no flags, no arguments, no nothing. she just looks. iconic behaviour, no cap 🎀

---

🦋 DESCRIPTION 🦋

so here's the tea, bestie 🍓

chkwtmp examines the file /var/log/wtmp for entries which have been overwritten (containing only null-bytes). yep — overwritten. gone. ghosted. the entry literally got replaced with nothing but null-bytes and now it's just sitting there like 💀

if such entries are found, the program displays the timestamps of the entries before and after the deleted entry — which lowkey gives you an idea of when the entry was deleted. a little timeline reconstruction moment, main character detective energy fr fr 🔥

and here's the practical bit: chkwtmp needs to be able to read /var/log/wtmp. normally this file is world-readable, so no special privileges are required — no sudo, no drama, you can just run it 🫶

---

🎀 FILES 🎀

• /var/log/wtmp — database of logins and logouts. that's her. that's the file. the whole reason we're here 💜

---

🌈 SEE ALSO 🌈

• wtmp(4)
• who(1)

go read those too, they're the extended universe iykyk ✨

---

⭐ LIMITATIONS ⭐

okay now the fine print, and pls actually read this one bestie:

• An entry is recognized as overwritten if the time-information has been overwritten with null-bytes.

so like — the detection is specifically keyed on the time info being nulled out. that's the trigger. noted. 📝

• This program was originally designed to run on SunOS 4.x systems. On other systems the output is undefined.

🚨 okay this is the big one 🚨 she's an OG SunOS 4.x girl, and on anything else the output is undefined — meaning nobody's promising you anything sensible comes out. no guessing, no cap. run it elsewhere at your own risk, babe 😭

---

and that's the whole page!! so cute, so short, so useful. go check your wtmp, be safe, hydrate 💖

written under the System Manager's Manual, dated Oct 23, 2021 — mwah, love u, bye 👑