Interesting With wtmp linked to /dev/null the "last" command gives wtmp begins Wed Dec 31 19:00:08 1969 I wonder where it is getting this date in 1969 from. .