/var/log/wtmp$     f ActLog
/var/log/wtmp\\.1$ f Full+ARF
