Provided by: chkrootkit_0.52-2_amd64
chklastlog - check lastlog-file for deleted entries
Chklastlog is reading all entries from the file /var/log/wtmp (file with information about logins and logouts) and checks for every user found in this file whether there is an entry in the file /var/log/lastlog, too. The program will complain about userids with logins but no lastlogin information. To run chklastlog you need read permission on the files /var/log/wtmp and /var/log/lastlogin. Normally these files are world-readable and no special privileges are required to run the checker.
/var/log/wtmp login data base /var/log/lastlog last login times
This program only works if the user has not logged in after the deletion of their lastlog entry. This program was designed to run on SunOS 4.x systems only. On other systems the output is undefined...