last login date

[haeman]

I would like to know the last login date of all users , I use the command "last |grep userid" , that only show the information of current month , I know the file /var/log/lastlog have this information , can advise if I want to know user's last login date over 1 month , what can i do ? thx

[Matti_Kurkela]

(No need to use grep with the "last" command: the syntax "last userid" should work just the same.)

The "last" command usually reads /var/log/wtmp, not /var/log/lastlog.

Many Linux distributions have a "logrotate" tool that is usually configured to archive the system logs, including /var/log/lastlog and /var/log/wtmp, with some cycle. The usual cycle for the lastlog and wtmp files is once a month, and the archiving is set to happen on 1st of each month.

Go to the /var/log directory and look for files named like "wtmp.1" or "wtmp.1.gz": these are the archived versions of the files. If they have a .gz suffix, logrotate has compressed them and you may need to use gunzip to uncompress them before examining them.

You can usually use "last -f /var/log/wtmp.1 userid" to check the information of the previous month. If you want to store the login information for a longer time, modify the logrotate settings in /etc/logrotate.conf and/or in files in the /etc/logrotate.d directory as required.

Please read "man logrotate" for more information.

MK

[skt_skt · Accepted solution]

if the growth of the wtmp is not high you can avoid the log rotate on that to keep more information

[Jared Middleton]

I increase the number of months of saved login history from 1 to 12 on all my RH linux servers as follows:
$ vi /etc/logrotate.conf
(find the /var/log/wtmp section)
rotate 12 (was rotate 1)

-Jared

[Jared Middleton]

I also have a script to expand the standard "last" command. Snippet:

last "$@"
for cnt in $(seq 12)
do
[ -a /var/log/wtmp.$cnt ] || break
last -f /var/log/wtmp.$cnt "$@"
done

Jared