View rotated log files Mac OS X Server (*.?.gz)

gziplog-filesmac-osxmac-osx-server

Trying to look at some of our older log files and find they're cryptic "Unix Executable Files". This particular server I'm working with is an older Mac OS X Server (10.4 – Tiger).

-rw-r-----   1 root  admin         36  1 Jun 15:48 wtmp
-rw-r--r--   1 root  admin        578 27 May 17:40 wtmp.0.gz
-rw-r-----   1 root  admin         89 26 Apr 13:57 wtmp.1.gz
-rw-r-----   1 root  admin         78 29 Mar 16:43 wtmp.2.gz
-rw-r-----   1 root  admin         69 15 Feb 17:21 wtmp.3.gz
-rw-r-----   1 root  admin        137 16 Jan 13:09 wtmp.4.gz

i'm using zless to try and view the contents of the .gz files. and what i see is unreadable:

...
<DF>^R<AF>ttyp1^@^@^@joe54^@^@^@^@^@108.184.63.22^@^@^@^@K<DF>"<B8>ttyp1^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@K<DF>%<A1>console^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@K<E0>1  ~^@^@^@^@^@^@^@shutdown^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@K<E0>1^L~^@^@^@^@^@^@^@reboot^@^@^@^@^@^@
...

same goes for system.log.0.gz, etc… anything that's been rolled in compressed .gz files. What am i missing?

Best Answer

The wtmp and utmp files are binary data - not text. Use last to view information in them.

From man utmp:

The file is a sequence of utmp structures, declared as follows in (note that this is only one of several definitions around; details depend on the version of libc):

blah, blah ... #defines and struct foo and struct bar ...

Related Topic