last log

[heaman1]

I know the command "last" can show the user login record , so now when I use this command , it shows the user login record in this half year ( I didn't clear it for half year ) , can advise if I want clear the old record so that it only show the record from 1-feb-09 ( that mean clear the record before 1-feb-09 ) , what can i do ?

[Dennis Handly · Accepted solution]

You will have to use fwtmp(1M), then edit the file, then use fwtmp(1M) again:
/usr/sbin/acct/fwtmp < /var/adm/wtmp > wtmp.cpy
delete old stuff in wtmp.cpy
/usr/sbin/acct/fwtmp -ic < wtmp.cpy > /var/adm/wtmp

Add -X if editing wtmps.
You may lose info during this three step window.

[heaman1]

thx reply,

the comamand seems could be run in hp server , can advise if I want to do it at other unix-like server , what can i do ? thx

[avizen9]

besically you need to modify below file which is data file.

/var/adm/wtmp which contain all records for this command.

[heaman1]

thx reply ,

can advise how to modify the file wtmp ?

[Md. Farhan A Azam]

You can purge the file.

#> {file name}
but it will remove all data...and you will get log from now.

[heaman1]

thx ,

but how can I purge the data before 1-Feb ?

[Dennis Handly]

>can advise if I want to do it at other unix-like server, what can i do?

There are no other Unix-like servers except for HP-UX or Linux. :-)
You will have to look that info up elsewhere but fwtmp(1M) says it is standard.

>can advise how to modify the file wtmp?

I told you, use fwtmp(1M) to convert to ascii, then edit, then convert back.

>but how can I purge the data before 1-Feb?

You have to edit the ascii version. Either vi or with sed or awk.
Create the ascii file and see how hard it will be.

[heaman1]

thx reply ,

I really can't find the command fwtmp in my linux box , also can't find it at rpmfind , can advise if there is other method to do that ? thx

[Dennis Handly]

>I really can't find the command fwtmp in my linux box

Have you look at the man pages for last, wtmp?
This is the wrong forum for linux questions. you have created another thread there:
http://forums.itrc.hp.com/service/forums/categoryhome.do?categoryId=188