Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The last command may show too few lines of user login info, truncated by when the “wtmp begins”.

If I want to get as much as possible last info (e.g., to see if my system was accessed from any unknown/suspicious IP using my username), how can I output the older “last” info?

If I use last -2000, intending to see 2000 lines of output, but the command may only return just a few lines, anything that happened before the “wtmp begins” would be truncated.)

Just wondering somehow if it is possible to output as many lines of login info as possible.

share|improve this question
last -o might help. The man page says it reads old wtmp files. But on my system it doesn't give much info. Although, wtmp begins sets to Jan 1 1970. – udiboy1209 Apr 4 '14 at 7:41
that's funny. if you have more logins since 1970 than what are shown in your log, then some setting may be incorrect. – water stone Apr 4 '14 at 8:57
up vote 6 down vote accepted

The last command uses the binary file /var/log/wtmp to show a listing of last logged in users.

But /var/log/wtmp is a rotated file where old entries are archived into /var/log/wtmp.x where x is a digit [0-9].

So If you need to look deeper in the login history, try to open one of those files:

last -2000 -f /var/log/wtmp.1 | less
share|improve this answer
To read 2000 line in terminal it is better to pass it to less as last -2000 -f /var/log/wtmp.1| less, +1 for nice answer – souravc Apr 4 '14 at 8:01
Good idea, thanks @souravc. I've edited my answer. – Sylvain Pineau Apr 4 '14 at 8:03
Thank you so very much! I noticed that the wtmp.1 file was automatically gzipped into wtmp.1.gz file, so I unzipped it, and used "last -f" to read, that is exactly what I needed. Thank you so much. Btw, the wtmp.1 seems still too recent, and I only have wtmp1 file (no other files such as wtmp2 etc in /var/log), if I want my system to store more info, how can I change the default system setting for this purpose? – water stone Apr 4 '14 at 8:21
Please create a new question to cover how many rotations should be archived. – Sylvain Pineau Apr 4 '14 at 8:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.