On 01/30/18 16:21, m.roth at 5-cent.us wrote: > Interesting. lastlog was always my go-to. However, at least in C6, last > gets it, while lastlog does not. > > How odd. Did you check /var/log/secure ? last command not mentioning logged i9n users will raise very big red flag for me. I also would check for something benign, like full filesystem. And hard drive errors. But the very first thing I would do: check the integrity of your box - whichever host integrity tool you use... Good luck. Valeri > > mark > > _______________________________________________ > CentOS mailing list > CentOS at centos.org > https://lists.centos.org/mailman/listinfo/centos > -- ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++