For those who are reading this, this is about a Mt. Lion system with current patches 10.8.3
Thank you for the reply and the pointer to the audit directory.
I am continuing to ponder why last at the terminal is given unexpected behavior. I am now noticing the history in last is only for the "last" - no pun intended - 24 hours or there abouts on one of my systems. In the audit directory there are many more entries
Wed Mar 20 09:47:14 terry@mymac:~ >>last
terry ttys001 Wed Mar 20 09:47 still logged in
terry ttys000 Wed Mar 20 09:47 still logged in
terry console Wed Mar 20 09:41 still logged in
reboot ~ Wed Mar 20 09:39
shutdown ~ Wed Mar 20 09:39
terry ttys001 Wed Mar 20 09:03 - 09:13 (00:09)
terry ttys000 Wed Mar 20 09:03 - 09:13 (00:09)
terry console Wed Mar 20 09:03 - 09:39 (00:35)
reboot ~ Wed Mar 20 09:00
wtmp begins Wed Mar 20 00:56
>>sudo ls -lsa /var/audit/
256 -r--r----- | 1 root wheel 130862 Nov 24 14:52 20121124213110.20121124225215 |
56 -r--r----- | 1 root wheel | 26733 Nov 24 15:23 20121124225256.20121124232301 |
40 -r--r----- | 1 root wheel | 19634 Nov 24 15:43 20121124232348.20121124234351 |
...
and then DOZENS and DOZENS more.... and finally those for yesterday are missing and then today.
2016 -r--r----- | 1 root wheel 1031355 Mar 18 23:31 20130318150701.20130319063139 |
840 -r--r----- | 1 root wheel 426232 Mar 20 00:56 20130319154442.20130320075621 |
56 -r--r----- | 1 root wheel | 26259 Mar 20 09:39 20130320160056.20130320163908 |
40 -r--r----- | 1 root wheel | 19050 Mar 20 09:55 20130320163956.not_terminated |
Also when I look thru the list of audit file the 15th and the 10th of Mar are missing..... hummmmm...
Any idea what could cause this?
I am suspicion of some sort of hacking but just see any direct evidence of it ....
I have gone an gotten the source code for last at the BSD project but Im' not a c programmer and apple's version is a branch or so it seems to me cause they've got to be different and I'm not sure where to configure last or how to better understand what I'm seeing.
Anyone care to help me understand what could be going on?