Home / server / Questions / 80939
Accepted
thepocketwade
Asked: 2009-11-04 05:19:15 +0800 CST

How to find who was logged in before beginning of wtmp

  • 772

I'm trying to determine who was recently logged into a specific machine in my office. So I used last, but wtmp begins yesterday (Monday) around 14:30. I was hoping to find info stretching back to Sunday, at least. Is there anyway to get that info without plodding through the authorization log file?

linux

2 Answers

  1. Best Answer

    Presumably your wtmp file has been rotated, so try last -f /var/log/wtmp.1 or last -f /var/log/wtmp.0 to read the previous files. If those don't work, ls /var/log/wtmp* and see if they're called something else. If they're compressed (.gz extension), decompress 'em.

    If they're not there, find whoever setup the bollocks rotation scheme and give them a solid foot-punch to the pantaloons. There's no reason not to keep at least a few weeks' of wtmp logs.

    • 34

  2. If the wtmp files are not available, you can also look directly at /var/log/secure or /var/log/messages to see any login message in there.

    • 3