difference between last and lastb

[senthil_kumar_1]

Hi

what is the difference between last and lastb.

i think both are used to view the last logged in users.

Because "last" show one month login report (May 2009 only). but "lastb" is showing last 8 months rport.

how it is possible?

[Pete Randall · Accepted solution]

last=successful logins & searches the wtmp file
lastb=unsuccessful logins & searches the btmp file


Pete

[Bijeesh]

hi
The lastb command searches backwards through the database file
/var/adm/btmp to display bad login information.

The last command searches backwards through the file /var/adm/wtmp
(which contains a record of all logins and logouts) for information about a user, a tty, or any group of users and ttys.

see man page last.

[Ganesan R]

Hi Senthilkumar,

last command searches backwards through the file /var/adm/wtmp which contains a record of all logins and logouts.

lastb command searches backwards through the database file /var/adm/btmp which contains bad login informations.

[Jestin John Chacko]

last shows the successful login attempts including the time logged inand uses /var/adm/wtmp
(login database) for its functioning.lastb shows the unsuccessful login attempts uses /var/adm/btmp(bad login database)

>>>how it is possible?

its clear that somebody trimmed your wtmp file one month back and your btmp file is unaffected still now.

[Fabio Ettore]

Hi,

as described by Pete last reads wtmp file and lastb btmp file. If you see last command just showing last month it could be that someone zeroed it one month ago and didn't touch btmp, something like:

> /var/adm/wtmp

I saw to do that when the wtmp file grows up so much to fill up the /var filesystem, in that case zeroing this kind of file usually is a good action to free space from /var.

HTH.

Best regards,
Fabio

[UVK]

last shows the successful login's and uses the file wtmp where as lastb shows the failed login's and uses the file btmp. These files tend to grow with out limit unless you trim them maunally or by automation. You admins must have trimmed the file btmp a month before so you only have 1 month information.

[Kranti Mahmud]

Hi Senthil,

last command searches backwards through the file /var/adm/wtmp which contains a record of all logins and logouts.

lastb command searches backwards through the database file /var/adm/btmp which contains bad login informations.

Rgds-Kranti

[Suraj K Sankari]

Hi,

last, lastb - show listing of last logged in users

last searches backwards through file /etc/wtmp (which contains a record of all logins and logouts) for information about a user, a tty, or any group of users and ttys.

Lastb is the same as last, except that by default it shows a log of the file /var/log/btmp, which contains all the bad login attempts.


Suraj