cancel
Showing results for 
Search instead for 
Did you mean: 

last log

 
SOLVED
Go to solution
heaman1
Regular Advisor

last log

I know the command "last" can show the user login record , so now when I use this command , it shows the user login record in this half year ( I didn't clear it for half year ) , can advise if I want clear the old record so that it only show the record from 1-feb-09 ( that mean clear the record before 1-feb-09 ) , what can i do ?
11 REPLIES 11
Dennis Handly
Acclaimed Contributor
Solution

Re: last log

You will have to use fwtmp(1M), then edit the file, then use fwtmp(1M) again:
/usr/sbin/acct/fwtmp < /var/adm/wtmp > wtmp.cpy
delete old stuff in wtmp.cpy
/usr/sbin/acct/fwtmp -ic < wtmp.cpy > /var/adm/wtmp

Add -X if editing wtmps.
You may lose info during this three step window.
heaman1
Regular Advisor

Re: last log

thx reply,

the comamand seems could be run in hp server , can advise if I want to do it at other unix-like server , what can i do ? thx
avizen9
Esteemed Contributor

Re: last log

besically you need to modify below file which is data file.

/var/adm/wtmp which contain all records for this command.
heaman1
Regular Advisor

Re: last log

thx reply ,

can advise how to modify the file wtmp ?
Md. Farhan A Azam
Trusted Contributor

Re: last log

You can purge the file.

#> {file name}
but it will remove all data...and you will get log from now.
heaman1
Regular Advisor

Re: last log

thx ,

but how can I purge the data before 1-Feb ?
Dennis Handly
Acclaimed Contributor

Re: last log

>can advise if I want to do it at other unix-like server, what can i do?

There are no other Unix-like servers except for HP-UX or Linux. :-)
You will have to look that info up elsewhere but fwtmp(1M) says it is standard.

>can advise how to modify the file wtmp?

I told you, use fwtmp(1M) to convert to ascii, then edit, then convert back.

>but how can I purge the data before 1-Feb?

You have to edit the ascii version. Either vi or with sed or awk.
Create the ascii file and see how hard it will be.
heaman1
Regular Advisor

Re: last log

thx reply ,

I really can't find the command fwtmp in my linux box , also can't find it at rpmfind , can advise if there is other method to do that ? thx
Dennis Handly
Acclaimed Contributor

Re: last log

>I really can't find the command fwtmp in my linux box

Have you look at the man pages for last, wtmp?
This is the wrong forum for linux questions. you have created another thread there:
http://forums.itrc.hp.com/service/forums/categoryhome.do?categoryId=188