Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

The last command may show too few lines of user login info, truncated by when the “wtmp begins”.

If I want to get as much as possible last info (e.g., to see if my system was accessed from any unknown/suspicious IP using my username), how can I output the older “last” info?

If I use last -2000, intending to see 2000 lines of output, but the command may only return just a few lines, anything that happened before the “wtmp begins” would be truncated.)

Just wondering somehow if it is possible to output as many lines of login info as possible.

share|improve this question
    
last -o might help. The man page says it reads old wtmp files. But on my system it doesn't give much info. Although, wtmp begins sets to Jan 1 1970. –  udiboy1209 Apr 4 at 7:41
    
that's funny. if you have more logins since 1970 than what are shown in your log, then some setting may be incorrect. –  waterstone Apr 4 at 8:57
add comment

1 Answer 1

up vote 3 down vote accepted

The last command uses the binary file /var/log/wtmp to show a listing of last logged in users.

But /var/log/wtmp is a rotated file where old entries are archived into /var/log/wtmp.x where x is a digit [0-9].

So If you need to look deeper in the login history, try to open one of those files:

last -2000 -f /var/log/wtmp.1 | less
share|improve this answer
    
To read 2000 line in terminal it is better to pass it to less as last -2000 -f /var/log/wtmp.1| less, +1 for nice answer –  souravc Apr 4 at 8:01
    
Good idea, thanks @souravc. I've edited my answer. –  Sylvain Pineau Apr 4 at 8:03
    
Thank you so very much! I noticed that the wtmp.1 file was automatically gzipped into wtmp.1.gz file, so I unzipped it, and used "last -f" to read, that is exactly what I needed. Thank you so much. Btw, the wtmp.1 seems still too recent, and I only have wtmp1 file (no other files such as wtmp2 etc in /var/log), if I want my system to store more info, how can I change the default system setting for this purpose? –  waterstone Apr 4 at 8:21
    
@user3496956, please vote (^) and accept my answer. Thanks. See askubuntu.com/help/someone-answers –  Sylvain Pineau Apr 4 at 8:22
    
Please create a new question to cover how many rotations should be archived. –  Sylvain Pineau Apr 4 at 8:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.