View rotated log files Mac OS X Server (*.?.gz)
Trying to look at some of our older log files and find they're cryptic "Unix Executable Files". This particular server I'm working with is an older Mac OS X Server (10.4 - Tiger).
-rw-r----- 1 root admin 36 1 Jun 15:48 wtmp
-rw-r--r-- 1 root admin 578 27 May 17:40 wtmp.0.gz
-rw-r----- 1 root admin 89 26 Apr 13:57 wtmp.1.gz
-rw-r----- 1 root admin 78 29 Mar 16:43 wtmp.2.gz
-rw-r----- 1 root admin 69 15 Feb 17:21 wtmp.3.gz
-rw-r----- 1 root admin 137 16 Jan 13:09 wtmp.4.gz
i'm using zless to try and view the contents of the .gz files. and what i see is unreadable:
...
<DF>^R<AF>ttyp1^@^@^@joe54^@^@^@^@^@108.184.63.22^@^@^@^@K<DF>"<B8>ttyp1^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@K<DF>%<A1>console^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@K<E0>1 ~^@^@^@^@^@^@^@shutdown^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@K<E0>1^L~^@^@^@^@^@^@^@reboot^@^@^@^@^@^@
...
same goes for system.log.0.gz, etc... anything that's been rolled in compressed .gz files. What am i missing?
The wtmp and utmp files are binary data - not text. Use last
to view information in them.
From man utmp
:
The file is a sequence of utmp structures, declared as follows in (note that this is only one of several definitions around; details depend on the version of libc):
blah, blah ... #defines and struct foo and struct bar ...