up vote 0 down vote favorite
share [g+] share [fb]

I'm trying to determine who was recently logged into a specific machine in my office. So I used last, but wtmp begins yesterday (Monday) around 14:30. I was hoping to find info stretching back to Sunday, at least. Is there anyway to get that info without plodding through the authorization log file?

link|improve this question
100% accept rate
feedback

2 Answers

up vote 3 down vote accepted

Presumably your wtmp file has been rotated, so try last -f /var/log/wtmp.1 or last -f /var/log/wtmp.0 to read the previous files. If those don't work, ls /var/log/wtmp* and see if they're called something else. If they're compressed (.gz extension), decompress 'em.

If they're not there, find whoever setup the bollocks rotation scheme and give them a solid foot-punch to the pantaloons. There's no reason not to keep at least a few weeks' of wtmp logs.

link|improve this answer
I really should have seen those rotated files in /var/log, I don't know how I missed them. – thepocketwade Nov 3 '09 at 13:35
feedback
up vote 0 down vote

If the wtmp files are not available, you can also look directly at /var/log/secure or /var/log/messages to see any login message in there.

link|improve this answer
I thought about that, but that's more work than I wanted to do, really. – thepocketwade Nov 6 '09 at 21:40
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.