Last command - very strange output

Question

When trying to execute "last" command I am getting my last logins mixed with the content from files that exists on that server.

for instance:

 <tbody tr>=0A    </         <tr>=0A  Sun Jan 20 22:18 - crash (3894+12:33)
left" bg   <tr>=0A    3D"padding:3px 9 Thu Sep  2 16:29 - crash (-5461+-4:-3
 </td>=0 sp;=0D=0A        </tr>=0D=0A  Wed Nov  2 12:41 - crash (-3696+-1:-4
                      >=0D=0A          Wed Aug 18 08:58 - crash (-5445+-21:-
               <tr>=0 =3D"padding:7px  Thu Mar 24 10:00 - crash (-3472+-23:-
h>=0D=0A                  <th align=3D Fri Jan 30 03:38 - crash (9364+07:14)
padding=        <tabl =3D"100%">=0D=0A Thu Oct 19 15:17 - crash (-4047+-3:-2

What could cause that? I am worry that somebody managed to put content from the files into last log and somehow manages to read it back revealing confidential information. I am the only user on the server.

Any help would be greatly appreciated.

Filesystem corruption? Especially with the "crash" messages. Can you run fsck? — cjc, Sep 19 '12 at 13:51

score 4 · Accepted Answer · answered Sep 20 '12 at 18:28

The output is suggestive of filesystem corruption: there seems to be the intermingling of the content of different files, and the readable portion of the last output suggests that the machine has crashed a bunch of times.

You should run an fsck on the filesystem.

Last command - very strange output

1 Answers1