topic Re: last log in Operating System - Linux

last log

heaman1 — Wed, 18 Feb 2009 03:50:16 GMT

I know the command "last" can show the user login record , so now when I use this command , it shows the user login record in this half year ( I didn't clear it for half year ) , can advise if I want clear the old record so that it only show the record from 1-feb-09 ( that mean clear the record before 1-feb-09 ) , what can i do ?

Re: last log

Steven E. Protter — Wed, 18 Feb 2009 13:05:48 GMT

Shalom,

Once a month or quarter or some time period:

> /var/log/btmp
> /var/log/wtmp

Back them up first if you want.

Those are the data files for lastb and last commands respectively.

The command empties them out.

SEP

Re: last log

Ivan Ferreira — Wed, 18 Feb 2009 13:12:21 GMT

You can use logrotate for rotating the logs and having only a specific period of time on them.

Re: last log

heaman1 — Thu, 19 Feb 2009 07:35:46 GMT

thx replis,

> seems reset the file , the data will totally lost , but I just want remove the data before 1-feb

logrotate needs to config sth , but I just want to do it one time only, is there simplier method ? thx

Re: last log

heaman1 — Thu, 19 Feb 2009 07:49:41 GMT

I know I can use last -f wtmp to export the file to text , then I can modify it , but how can I import back it to current wtmp ?

Re: last log

Vitaly Karasik_1 — Thu, 19 Feb 2009 07:50:50 GMT

BTW, I suggest to assing points for answers - for now there is "0 points for 64 answers" :-(

Re: last log

Dennis Handly — Sat, 21 Feb 2009 16:11:00 GMT

Do you have utmpdump? Does it have an option to write a wtmp file?
You may have to write your own fwtmp.