Audit Date/time changed

[Jason Chia]

Hi,

From my understand from man Date, every date/time changed to the system(either forward or backward) will logged in /var/wtmp file rite ? How am I generated report for Date/time changed for the past 6 months ? Is it thru command last ? This command shown more on login logs, how can I filter it to shown only date/time changed ?

Would appreciate any one can helps.Thanks.

[Michael Tully]

The date and time changes gets logged into /var/adm/syslog/syslog.log

The 'wtmp' file records successful user login activity only. You can only get user login information for as long as what is in the log file using the 'last' command. If you have older 'wtmp' files it is possible using the 'fwtmp' command.