topic Re: last log in Operating System - HP-UX

last log

heaman1 — Mon, 16 Feb 2009 06:46:18 GMT

I know the command "last" can show the user login record , so now when I use this command , it shows the user login record in this half year ( I didn't clear it for half year ) , can advise if I want clear the old record so that it only show the record from 1-feb-09 ( that mean clear the record before 1-feb-09 ) , what can i do ?

Re: last log

Dennis Handly — Mon, 16 Feb 2009 07:24:23 GMT

You will have to use fwtmp(1M), then edit the file, then use fwtmp(1M) again:
/usr/sbin/acct/fwtmp < /var/adm/wtmp > wtmp.cpy
delete old stuff in wtmp.cpy
/usr/sbin/acct/fwtmp -ic < wtmp.cpy > /var/adm/wtmp

Add -X if editing wtmps.
You may lose info during this three step window.

Re: last log

heaman1 — Wed, 18 Feb 2009 08:02:03 GMT

thx reply,

the comamand seems could be run in hp server , can advise if I want to do it at other unix-like server , what can i do ? thx

Re: last log

avizen9 — Wed, 18 Feb 2009 08:57:39 GMT

besically you need to modify below file which is data file.

/var/adm/wtmp which contain all records for this command.

Re: last log

heaman1 — Wed, 18 Feb 2009 09:07:19 GMT

thx reply ,

can advise how to modify the file wtmp ?

Re: last log

Md. Farhan A Azam — Wed, 18 Feb 2009 09:19:34 GMT

You can purge the file.

#> {file name}
but it will remove all data...and you will get log from now.

Re: last log

heaman1 — Wed, 18 Feb 2009 09:35:46 GMT

thx ,

but how can I purge the data before 1-Feb ?

Re: last log

Dennis Handly — Wed, 18 Feb 2009 11:44:02 GMT

>can advise if I want to do it at other unix-like server, what can i do?

There are no other Unix-like servers except for HP-UX or Linux. :-)
You will have to look that info up elsewhere but fwtmp(1M) says it is standard.

>can advise how to modify the file wtmp?

I told you, use fwtmp(1M) to convert to ascii, then edit, then convert back.

>but how can I purge the data before 1-Feb?

You have to edit the ascii version. Either vi or with sed or awk.
Create the ascii file and see how hard it will be.

Re: last log

heaman1 — Thu, 19 Feb 2009 07:06:44 GMT

thx reply ,

I really can't find the command fwtmp in my linux box , also can't find it at rpmfind , can advise if there is other method to do that ? thx

Re: last log

Dennis Handly — Thu, 19 Feb 2009 07:23:00 GMT

>I really can't find the command fwtmp in my linux box

Have you look at the man pages for last, wtmp?
This is the wrong forum for linux questions. you have created another thread there:
http://forums.itrc.hp.com/service/forums/categoryhome.do?categoryId=188

Re: last log

heaman1 — Thu, 19 Feb 2009 07:32:46 GMT

thx a lot

Re: last log

Roland Piette — Thu, 19 Feb 2009 09:56:22 GMT

Hello,

Maybe this simple command will help you.

last | sed -n '1,/Feb 9/p'

Becareful Feb 9 has separate by two spaces !
Command last display the record from most recently event.

Good luck,
Roland