last log

[heaman1]

I know the command "last" can show the user login record , so now when I use this command , it shows the user login record in this half year ( I didn't clear it for half year ) , can advise if I want clear the old record so that it only show the record from 1-feb-09 ( that mean clear the record before 1-feb-09 ) , what can i do ?

[Steven E. Protter]

Shalom,

Once a month or quarter or some time period:

> /var/log/btmp
> /var/log/wtmp

Back them up first if you want.

Those are the data files for lastb and last commands respectively.

The command empties them out.

SEP

[Ivan Ferreira]

You can use logrotate for rotating the logs and having only a specific period of time on them.

[heaman1]

thx replis,

> seems reset the file , the data will totally lost , but I just want remove the data before 1-feb

logrotate needs to config sth , but I just want to do it one time only, is there simplier method ? thx

[heaman1]

I know I can use last -f wtmp to export the file to text , then I can modify it , but how can I import back it to current wtmp ?

[Vitaly Karasik_1]

BTW, I suggest to assing points for answers - for now there is "0 points for 64 answers" :-(

[Dennis Handly · Accepted solution]

Do you have utmpdump? Does it have an option to write a wtmp file?
You may have to write your own fwtmp.