Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to determine who was recently logged into a specific machine in my office. So I used last, but wtmp begins yesterday (Monday) around 14:30. I was hoping to find info stretching back to Sunday, at least. Is there anyway to get that info without plodding through the authorization log file?

share|improve this question
up vote 23 down vote accepted

Presumably your wtmp file has been rotated, so try last -f /var/log/wtmp.1 or last -f /var/log/wtmp.0 to read the previous files. If those don't work, ls /var/log/wtmp* and see if they're called something else. If they're compressed (.gz extension), decompress 'em.

If they're not there, find whoever setup the bollocks rotation scheme and give them a solid foot-punch to the pantaloons. There's no reason not to keep at least a few weeks' of wtmp logs.

share|improve this answer
I really should have seen those rotated files in /var/log, I don't know how I missed them. – thepocketwade Nov 3 '09 at 13:35

If the wtmp files are not available, you can also look directly at /var/log/secure or /var/log/messages to see any login message in there.

share|improve this answer
I thought about that, but that's more work than I wanted to do, really. – thepocketwade Nov 6 '09 at 21:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.