How to read older login info using the "last" command?
The last
command uses the binary file /var/log/wtmp
to show a listing of last logged in users.
But /var/log/wtmp
is a rotated file where old entries are archived into /var/log/wtmp.x
where x is a digit [0-9]
.
So If you need to look deeper in the login history, try to open one of those files:
last -2000 -f /var/log/wtmp.1 | less
If the last -f /var/log/wtmp.1
doesn't give any output this can be because e.g. the record length has changed in a newer version.
A simply option would be then to use utmpdump instead:
utmpdump /var/log/wtmp.1 | less
Oh, and less
can be quitted using q (from "quit" ;-) )