how do I know the year of dates in the output of "last" command

[Hanry Zhou]

Some of lines withing the output definitely are not year 2004, but it did not specify which year. Is there anyway to find oout?

[Patrick Wallek]

Not that I know of.

[c_51]

last is a representation of the data in wtmp. and you can view the data in wtmp by using fwtmp.

might not be exactly what your looking for, but cat /etc/wtmp | /usr/sbin/acct/fwtmp will give you the year.

[Bill Hassell]

last (and lastb) do not show the year although it is included in the wtmp (and btmp) entries. You'll have to use /usr/sbin/acct/fwtmp to decode the binary file and see the year. However, I would setup a logfile archive to prevent multi-year logs. Most of the data that is more than a year old is never used.

[Hein van den Heuvel]

If you do not want to go to wtmp, then you can compare the current day with the 'last' day and assume that any 'future' time is in fact in the paste, and claim it to be last year.

FOr an example of this, see my response in:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=726662

hth,
Hein.

[Steven E. Protter]

The output of this command:

strings /var/adm/wtmp

Will give you some information as to the year of the log entries.

This system probably isn't very busy or has never had a log rotation if you've got data that old in it.

Its a very good idea to trim the logs once in a while. On my light duty systems, the following command is run on logs once a month in cron.

> /var/adm/wtmp
> /var/adm/btmp

...

other log files

Just a part of the housekeeping we have to do.

SEP

[MarkSyder]

Why do you want data over a year old in your wtmp file?

Trim it regularly to stop /var from filling!

Mark Syder (like the drink but spelt different)

[Hanry Zhou]

The customer wanted to list the LATEST login ONLY for all users on the system. So, I used "last -1" command on all user id's in /etc/passwd file. I expect it will give me what the customer wants. However, I found the date it shows don't include the year. It shows November, for instance, but it is not of 2004!

Did last -1 really give the latest login? and what if I wanted to add the year in each last -1 output.

As some of you suggested, fwtmp/strings would show me the year, but it is not really what I want. I just want find out the LATEST login, including MM/DD/YY.

Thanks,

[Bill Hassell]

The easiest way to get this information is with getprpw (but only on Trusted systems):

/usr/lbin/getprpw -m slogint,ulogint

This will show last successful login and last unsuccessful login, complete date including year. It's the information shown during a login. The man page for getprwpw is only on 11.11 systems but you can find it at docs.hp.com. For a non-trusted system, you'll have to use fwtmp.