topic Re: lastb log is not correct in Operating System - Linux

lastb log is not correct

peterchu — Mon, 01 Mar 2004 05:04:16 GMT

I use the command lastb to check the user login history , however , i found that there are problems , eg .
1. the user has access the system for 3 hours , but the lastb log show the login time is
" Mon Feb 23 09:33 - 09:33 (00:00) " ;

2.the user have login for many times , but the log only show part of the login history ,

could suggest how to fix it ? thx

Re: lastb log is not correct

Mark Grant — Mon, 01 Mar 2004 05:45:43 GMT

The last command gets it's information from /var/log/wtmp. This file, on some distributions gets "rotated" everynow and then. This means that any information is lost unless you point "last" at the old log with the "-f" information.

"lastb" uses /var/log/btmp and only shows bad logins, not the duration of the login.

Re: lastb log is not correct

peterchu — Mon, 01 Mar 2004 05:58:24 GMT

thx reply , if lastb is not shown the duration of the user login , what command / method can show this informatoin ? thx.

Re: lastb log is not correct

Alexander Chuzhoy — Mon, 01 Mar 2004 06:18:53 GMT

try the ac utility wich is a part of psacct
rpm.

Re: lastb log is not correct

Mark Grant — Mon, 01 Mar 2004 06:20:49 GMT

Well, also, "last" will.

Re: lastb log is not correct

peterchu — Mon, 01 Mar 2004 06:58:59 GMT

thx reply, the last is OK , but it only keep one day information , how to set it can keep longer log ? thx.

Re: lastb log is not correct

Mark Grant — Mon, 01 Mar 2004 07:06:27 GMT

You should find out what it is that is "rotating" the wtmp log file. I imagine it's cron. If you do a "crontab -l" as root, you might find it and change it to run every few months or not at all. I think Red Hat does soem annoying cron stuff to stop you seeing what it does every day and every hour though.

Try looking at /etc/cron/cron.daily if this is the case for you.

Re: lastb log is not correct

Martin P.J. Zinser — Mon, 01 Mar 2004 21:59:45 GMT

Also at least on my system the "old" logfiles are stored as
/var/log/wtmp-.gz.

So if you do need the information you can uncompress them and process them with last -f as suggested before.

Greetings, Martin