topic Re: last login date in Operating System - Linux

last login date

haeman — Fri, 28 Mar 2008 02:57:02 GMT

I would like to know the last login date of all users , I use the command "last |grep userid" , that only show the information of current month , I know the file /var/log/lastlog have this information , can advise if I want to know user's last login date over 1 month , what can i do ? thx

Re: last login date

Matti_Kurkela — Fri, 28 Mar 2008 06:48:53 GMT

(No need to use grep with the "last" command: the syntax "last userid" should work just the same.)

The "last" command usually reads /var/log/wtmp, not /var/log/lastlog.

Many Linux distributions have a "logrotate" tool that is usually configured to archive the system logs, including /var/log/lastlog and /var/log/wtmp, with some cycle. The usual cycle for the lastlog and wtmp files is once a month, and the archiving is set to happen on 1st of each month.

Go to the /var/log directory and look for files named like "wtmp.1" or "wtmp.1.gz": these are the archived versions of the files. If they have a .gz suffix, logrotate has compressed them and you may need to use gunzip to uncompress them before examining them.

You can usually use "last -f /var/log/wtmp.1 userid" to check the information of the previous month. If you want to store the login information for a longer time, modify the logrotate settings in /etc/logrotate.conf and/or in files in the /etc/logrotate.d directory as required.

Please read "man logrotate" for more information.

MK

Re: last login date

skt_skt — Fri, 28 Mar 2008 11:04:52 GMT

if the growth of the wtmp is not high you can avoid the log rotate on that to keep more information

Re: last login date

Jared Middleton — Fri, 28 Mar 2008 22:56:50 GMT

I increase the number of months of saved login history from 1 to 12 on all my RH linux servers as follows:
$ vi /etc/logrotate.conf
(find the /var/log/wtmp section)
rotate 12 (was rotate 1)

-Jared

Re: last login date

Jared Middleton — Fri, 28 Mar 2008 23:01:27 GMT

I also have a script to expand the standard "last" command. Snippet:

last "$@"
for cnt in $(seq 12)
do
[ -a /var/log/wtmp.$cnt ] || break
last -f /var/log/wtmp.$cnt "$@"
done

Jared