Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

On Solaris, there the command 'fwtmp' provide the year information from the wtmp logs. For example:

host # /usr/lib/acct/fwtmp < /var/adm/wtmpx > tmp_wtmpx_file
host # head -1 tmp_wtmpx_file
user123 sshd 1258 7 0000 0000 1226072918 230489 0 29 host123.desktop.ourhost.com Fri Nov  7 09:48:38 2008

On Linux, the 'last' outputs the data without the year information, and I don't seem to be able to find a utility similar to 'fwtmp' on Linux to add the year data. The 'lastlog' command includes year in the output, but only looks up the users that are in the passwd file (not against ldap or other user databases by default). Is there a utility on Linux that will output the year along with the other data from 'last'?

share|improve this question

2 Answers 2

up vote 5 down vote accepted
man last
...
       -F     Print full login and logout times and dates.
...

So, use last -F

share|improve this answer
    
Not sure how I missed that. Thanks. –  Andrew Case Mar 30 '12 at 17:00
    
It's not available in RHEL5/CentOS5, though. –  ewwhite Nov 7 at 12:49

On RHEL5, last -F isn't available.

If you want to have only the last informations from a specific year, you need to use last -t.

ex:

  • last -t 20140101000000 show everything before 2014.
  • last -t 20130101000000 show everything before 2013.

if you run a diff between the 2 commands, you can have only informations for 2013.

See Getting "year" with last command on Red Hat 5 for more informations if needed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.