Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to determine who was recently logged into a specific machine in my office. So I used last, but wtmp begins yesterday (Monday) around 14:30. I was hoping to find info stretching back to Sunday, at least. Is there anyway to get that info without plodding through the authorization log file?

share|improve this question
add comment

2 Answers

up vote 13 down vote accepted

Presumably your wtmp file has been rotated, so try last -f /var/log/wtmp.1 or last -f /var/log/wtmp.0 to read the previous files. If those don't work, ls /var/log/wtmp* and see if they're called something else. If they're compressed (.gz extension), decompress 'em.

If they're not there, find whoever setup the bollocks rotation scheme and give them a solid foot-punch to the pantaloons. There's no reason not to keep at least a few weeks' of wtmp logs.

share|improve this answer
    
I really should have seen those rotated files in /var/log, I don't know how I missed them. –  thepocketwade Nov 3 '09 at 13:35
add comment

If the wtmp files are not available, you can also look directly at /var/log/secure or /var/log/messages to see any login message in there.

share|improve this answer
    
I thought about that, but that's more work than I wanted to do, really. –  thepocketwade Nov 6 '09 at 21:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.