How to read older login info using the "last" command?

The last command uses the binary file /var/log/wtmp to show a listing of last logged in users.

But /var/log/wtmp is a rotated file where old entries are archived into /var/log/wtmp.x where x is a digit [0-9].

So If you need to look deeper in the login history, try to open one of those files:

last -2000 -f /var/log/wtmp.1 | less

If the last -f /var/log/wtmp.1 doesn't give any output this can be because e.g. the record length has changed in a newer version.

A simply option would be then to use utmpdump instead:

utmpdump /var/log/wtmp.1  | less

Oh, and less can be quitted using q (from "quit" ;-) )

Tags:

Command Line