Solved

"last" command

Posted on 2004-08-08
3
305 Views
Last Modified: 2010-04-20
Dear Expert,
In the man page, last command will display all users login into the system since day one setup, however I found my system only display recent one month only, eventhough my system has been setup for years. Where to set to enable the system to track user login for longer period of time?
Thanks you in advance.
Linux Novice,
OMLoo
0
Comment
Question by:omloo
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 4

Expert Comment

by:net_sec_guru
ID: 11749576
you can do a:

last -t <YYYYMMDDHHMMSS>

This will give you a list from that specified date. It gives status of all logins as of that time of date.

Is this what you're looking for?

0
 
LVL 20

Expert Comment

by:Gns
ID: 11751387
This is truncated in the logrotate subsystem, which is there to see to it that logfiles (and similar) don't grow to fill the hdd completely.
Look in the file /etc/logrotate.conf for mention of the wtmp file... Chances are great that you have a stanza like this:
# no packages own lastlog or wtmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 1
}
... which should be selfexplanatory more or less. Look at the manpage for logrotate where the fileformat is documented.

-- Glenn
0
 
LVL 20

Accepted Solution

by:
Gns earned 50 total points
ID: 11751431
Note that you could either remove it from the "logrotations", or set "rotate X" where X is the number of "old files" to keep. In the latter case you'd have /var/log/wtmp for the current month, /var/log/wtmp.1 for the previous month, /var/log/wtmp.2 for the month before that etc up to the total number of files == X. Then you could do "last -f /var/tmp/wtmp.1 ...".
The bad thing with wtmp files like that would be for sessions going "over the month edges", where it couldn't determine start/end of such a session (depending on which file you looked at).
But generally, this is viewed as no big deal:-).

-- Glenn
0

Featured Post

Tutorials alone can't teach real engineering

So we built better training tools.

-Hands-on Labs
-Instructor Mentoring
-Scenario-Based Tests
-Dedicated Cloud Servers

All at your fingertips. What are you waiting for?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SSH (Secure Shell) - Tips and Tricks As you all know SSH(Secure Shell) is a network protocol, which we use to access/transfer files securely between two networked devices. SSH was actually designed as a replacement for insecure protocols that sen…
I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension (http://www.experts-exchange.com/discussions/210281/Attachments-with-no-extension.html). This reminded me of questions tha…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question