lastb log is not correct

[peterchu]

I use the command lastb to check the user login history , however , i found that there are problems , eg .
1. the user has access the system for 3 hours , but the lastb log show the login time is
" Mon Feb 23 09:33 - 09:33 (00:00) " ;

2.the user have login for many times , but the log only show part of the login history ,

could suggest how to fix it ? thx

[Mark Grant · Accepted solution]

The last command gets it's information from /var/log/wtmp. This file, on some distributions gets "rotated" everynow and then. This means that any information is lost unless you point "last" at the old log with the "-f" information.

"lastb" uses /var/log/btmp and only shows bad logins, not the duration of the login.

[peterchu]

thx reply , if lastb is not shown the duration of the user login , what command / method can show this informatoin ? thx.

[Alexander Chuzhoy]

try the ac utility wich is a part of psacct
rpm.

[Mark Grant]

Well, also, "last" will.

[peterchu]

thx reply, the last is OK , but it only keep one day information , how to set it can keep longer log ? thx.

[Mark Grant]

You should find out what it is that is "rotating" the wtmp log file. I imagine it's cron. If you do a "crontab -l" as root, you might find it and change it to run every few months or not at all. I think Red Hat does soem annoying cron stuff to stop you seeing what it does every day and every hour though.

Try looking at /etc/cron/cron.daily if this is the case for you.

[Martin P.J. Zinser]

Also at least on my system the "old" logfiles are stored as
/var/log/wtmp-.gz.

So if you do need the information you can uncompress them and process them with last -f as suggested before.

Greetings, Martin