22

The last command may show too few lines of user login info, truncated by when the “wtmp begins”.

If I want to get as much as possible last info (e.g., to see if my system was accessed from any unknown/suspicious IP using my username), how can I output the older “last” info?

If I use last -2000, intending to see 2000 lines of output, but the command may only return just a few lines, anything that happened before the “wtmp begins” would be truncated.)

Just wondering somehow if it is possible to output as many lines of login info as possible.

2
  • last -o might help. The man page says it reads old wtmp files. But on my system it doesn't give much info. Although, wtmp begins sets to Jan 1 1970.
    – udiboy1209
    Commented Apr 4, 2014 at 7:41
  • 1
    that's funny. if you have more logins since 1970 than what are shown in your log, then some setting may be incorrect. Commented Apr 4, 2014 at 8:57

3 Answers 3

27

The last command uses the binary file /var/log/wtmp to show a listing of last logged in users.

But /var/log/wtmp is a rotated file where old entries are archived into /var/log/wtmp.x where x is a digit [0-9].

So If you need to look deeper in the login history, try to open one of those files:

last -2000 -f /var/log/wtmp.1 | less
4
  • 1
    To read 2000 line in terminal it is better to pass it to less as last -2000 -f /var/log/wtmp.1| less, +1 for nice answer
    – sourav c.
    Commented Apr 4, 2014 at 8:01
  • Good idea, thanks @souravc. I've edited my answer. Commented Apr 4, 2014 at 8:03
  • 1
    Thank you so very much! I noticed that the wtmp.1 file was automatically gzipped into wtmp.1.gz file, so I unzipped it, and used "last -f" to read, that is exactly what I needed. Thank you so much. Btw, the wtmp.1 seems still too recent, and I only have wtmp1 file (no other files such as wtmp2 etc in /var/log), if I want my system to store more info, how can I change the default system setting for this purpose? Commented Apr 4, 2014 at 8:21
  • Please create a new question to cover how many rotations should be archived. Commented Apr 4, 2014 at 8:26
5

If the last -f /var/log/wtmp.1 doesn't give any output this can be because e.g. the record length has changed in a newer version.

A simply option would be then to use utmpdump instead:

utmpdump /var/log/wtmp.1  | less

Oh, and less can be quitted using q (from "quit" ;-) )

1
  • 1
    Have your first 10 points ever, 1 year later! Commented Feb 3, 2020 at 11:48
1

Update

Logs in

/var/log/wtmp.1

are constrained.

Ubuntu 16 and probably 17 have mechanism of deleting logs older than one month. To configure this behavior you should edit:

/etc/logrotate.conf

More info:

Access to logs of startup and shut down

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .