"last" command

Dear Expert,
In the man page, last command will display all users login into the system since day one setup, however I found my system only display recent one month only, eventhough my system has been setup for years. Where to set to enable the system to track user login for longer period of time?
Thanks you in advance.
Linux Novice,
OMLoo
omlooAsked:
Who is Participating?
 
GnsConnect With a Mentor Commented:
Note that you could either remove it from the "logrotations", or set "rotate X" where X is the number of "old files" to keep. In the latter case you'd have /var/log/wtmp for the current month, /var/log/wtmp.1 for the previous month, /var/log/wtmp.2 for the month before that etc up to the total number of files == X. Then you could do "last -f /var/tmp/wtmp.1 ...".
The bad thing with wtmp files like that would be for sessions going "over the month edges", where it couldn't determine start/end of such a session (depending on which file you looked at).
But generally, this is viewed as no big deal:-).

-- Glenn
0
 
net_sec_guruCommented:
you can do a:

last -t <YYYYMMDDHHMMSS>

This will give you a list from that specified date. It gives status of all logins as of that time of date.

Is this what you're looking for?

0
 
GnsCommented:
This is truncated in the logrotate subsystem, which is there to see to it that logfiles (and similar) don't grow to fill the hdd completely.
Look in the file /etc/logrotate.conf for mention of the wtmp file... Chances are great that you have a stanza like this:
# no packages own lastlog or wtmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 1
}
... which should be selfexplanatory more or less. Look at the manpage for logrotate where the fileformat is documented.

-- Glenn
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.